I found access logs, no logs for 403.
Then I created my own js script to fetch data from my php source (status 200), to fetch data from php source which intentionally returns 403 (it was logged in access logs) and finally to fetch data from /lib/ajax/service-nologin.php which returned 403 without any log.
So I guess you are right since my Moodle app runs in docker but physically it is on very protected server, I will contact maintenance guys to check if they have some kind of protection.
I also noticed that ajax calls to /lib/ajax/service-nologin.php have encoded json in query parameter, so I believe that can be subject of blocking.
Then I created my own js script to fetch data from my php source (status 200), to fetch data from php source which intentionally returns 403 (it was logged in access logs) and finally to fetch data from /lib/ajax/service-nologin.php which returned 403 without any log.
So I guess you are right since my Moodle app runs in docker but physically it is on very protected server, I will contact maintenance guys to check if they have some kind of protection.
I also noticed that ajax calls to /lib/ajax/service-nologin.php have encoded json in query parameter, so I believe that can be subject of blocking.
Will let you know...
Thanks!