Is it all client side?

I wonder how many cookies/secret headers will be pasted by unaware and unknowing users.