I finally resolved the issue. There was nothing wrong with the Casbin enforcer, but rather with the CORS filter in Casdoor. The CORS settings in Casdoor depend on the application's redirect URLs, but for some reason a valid redirect URL was receiving a 403 error in the GET /api/get-user endpoint. I dug into the codebase, but everything seemed fine. My solution was to write the redirect URL as a regex, which resolved the 403 error. This might interest you.
Update: When only containing the host part (e.g., https://example.com), everything works fine. However, if there is a path included in the redirect URL (even just a slash like https://example.com/), issues arise.
https://github.com/casdoor/casdoor/issues/2916
@hsluoyz this is not a cheap question, I do know how to authecicate a public api, and request to /api/get-user with a valid JWT access token. But casdoor response 403 somehow, so I want to figure out why it happens. After dig in casdoor codebase, I realize this is a question related to casbin, so I create an issue ask for help.
