Some example code on how to use these headers to allow/reject requests:

https://web.dev/fetch-metadata/#step-5:-reject-all-other-req...