WordPress自定义REST API调用遇403 rest_forbidden及CORS问题求助

在WordPress站点搭建自定义REST API，调用时持续返回403错误，错误信息为"rest_forbidden": "Sorry, you are not allowed to do that."。已排查.htaccess配置、文件及文件夹权限并调试代码，均未发现异常。在Chrome DevTools中观察到请求的Referrer Policy为strict-origin-when-cross-origin，怀疑问题与此相关，恳请帮忙定位问题。

请求详情 #

Request URL: https://mysite/wp-json/agility/v1/body_reactions_exercise_submits/
Request Method: POST
Status Code: 403 
Remote Address: 93.192.149.128:443
Referrer Policy: strict-origin-when-cross-origin

响应头 #

access-control-allow-credentials: true
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
access-control-allow-methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
access-control-allow-origin: https://mysite.dk
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: no-cache, must-revalidate, max-age=0
content-type: application/json; charset=UTF-8
date: Mon, 07 Nov 2022 18:50:31 GMT
expires: Wed, 11 Jan 1984 05:00:00 GMT
link: <https://mysite.dk/wp-json/>; rel="https://api.w.org/"
server: Apache
simplycom-server: Apache
vary: Origin
x-content-type-options: nosniff
x-content-type-options: nosniff
x-robots-tag: noindex
x-wp-nonce: 4e1d47ebca

请求头 #

authority: mysite.dk
:method: POST
:path: /wp-json/agility/v1/body_reactions_exercise_submits/
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: en-GB,en;q=0.9,en-US;q=0.8,da;q=0.7
cache-control: no-cache
content-length: 39
content-type: application/x-www-form-urlencoded; charset=UTF-8
cookie: wf_loginalerted_deb7f1485ddd09882bf2b25862ac974db44f82cb0feb4afb7ac0dbeee3799b7b=4ff7d692ac9d5cb4526429c25da1fc5f6e3286dbba09472269b935b244bdcf30; wordpress_logged_in_673d309d9a05f5b76cf56a2a2ed5cfc7=su-admin-fll%7C1668019650%7CxFCQO4Nw6ul9VwbGAskysXfaf0y3a3ja7byhxPfK6XH%7C87853ea39548d983c701530c33c643c33f24bb068059eee2474fd2c1dd05d04b; wfwaf-authcookie-301c82f5ef5cb96a84d3b59d01978ec4=1%7Cadministrator%7Cmanage_options%2Cunfiltered_html%2Cedit_others_posts%2Cupload_files%2Cpublish_posts%2Cedit_posts%2Cread%7Cffd65b720d3f446ab3ad96e13abab2ad071e50d5df015313a664a9ec50ac84db; wp-settings-1=editor%3Dtinymce%26libraryContent%3Dbrowse; wp-settings-time-1=1667846872
dnt: 1
manage_options: true
origin: https://mysite.dk
pragma: no-cache
referer: https://mysite.dk/test-page/agility/agility-body-reaction/
sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-origin
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.35
x-requested-with: XMLHttpRequest
x-wp-nonce: 4e1d47ebca

JS代码 #

$.ajax({
        json/agility_body_reactions/v1/exercise_data_submits',
        url: 'https://MySite.dk/wp-json/agility/v1/body_reactions_exercise_submits/',
        method: 'POST',
        beforeSend: function(xhr) {
            xhr.setRequestHeader(
                'X-WP-Nonce',
                wpApiSettings.nonce );
        },
        data: {
                gender: gender,
                age: age,
                minutes: minutes,
                seconds: seconds
        }
});

内容的提问来源于stack exchange，提问作者Flemming Lemche