> The Sec-Fetch-Site header can't be read / written by Javascipt

Perfect. It's not even meant or needed to be. The server uses it to validate the request came from the expected site.

As i and others have said in various comments, you seem to be lost. Nothing you're saying has any relevance to the topic at hand. And, in fact, is largely wrong.