Given that you flagged this as “server side” and talking about the client machine, you might be disappointed.
The only way to verify this is with the code running on the host you are testing (that is, on the client) - of course, you could do this and send the response to the server (for example, for storage in a session)
Edit: It is also worth remembering that any headers you receive (or rely on receiving) can be removed by intermediate proxies or simply false (may be a bot)
source
share