Obviously, it comes from the user's machine so it can be modified before being sent to the server. Unless you're doing something custom/fancy like signing that data you shouldn't trust that it hasn't been tampered with.