Why does calling /api/signin return 403 Forbidden in SPA OAuth flow?

What could be a reason to get a 403 Forbidden when calling api/signin?code=<code>&state=<state>? I do get a valid access code when I call access api/login/oauth/access_token. Also, why do I need to call signin? (by the way, I'm on a SPA)

api/signin?code=&state= is for your application to handle, not for casdoor

Correct. My application calls this at the application callback URL, yet it gives me back a 403 Forbidden. Oddly, even if I don't call api/signin. I can still request an access_token.

I mean api/signin?code=&state= is a HTTP handler in your own app, not Casdoor

Found that strange too, also didn't see it in Swagger; but this is straight from the Casdoor sdk.js:

        const params = new URLSearchParams(window.location.search);
        const code = params.get("code");
        const state = params.get("state");
        const expectedState = this.getOrSaveState();
        this.clearState();
        if (state !== expectedState) {
            return new Promise((resolve, reject) => {
                setTimeout(() => {
                    resolve({
                        // @ts-ignore
                        status: "error",
                        msg: `invalid state parameter, expected: ${expectedState}, got: ${state}`,
                    });
                }, 10);
            });
        }
        return fetch(`${serverUrl}${signinPath  this.config.signinPath  '/api/signin'}?code=${code}&state=${state}`, {
            method: "POST",
            credentials: "include",
        }).then(res => res.json());
    }

I now think that the '/api/signin' here might be an artifact of an older version of Casdoor?

read the example code