here is my case.
you original page (with link) and the targeted linked page are not the same domain.
original-domain and target-domain.
if your target-domain not allow across-origin, then you get 403 forbidden error.
click link and enter url sending different request,
I found the difference is in request header:
click link (with 403 forbidden error),
request header have one line:
Referer: http://original-domain/json2tree/ipfs/ipfsList.html
when I enter url, (no 403 forbidden),
the request header does NOT have above line referer: original-domain
I finally figure out how to fix this error!!!
on your original-domain web page, you have to add
<meta name="referrer" content="no-referrer" />
it will remove or prevent sending the Referer in header, works both for links and for Ajax requests made