What happens?: Apparently the Wikibase REST API is blocking cross-origin access to search endpoints with a 403 error.

Steps to replicate the issue:

I share a snippet of JavaScript code which retrieves the JSON of a search with the REST API:

async function searchTest() {
  const url_test = `https://www.wikidata.org/w/rest.php/wikibase/v0/search/items?q=searchterm&language=en&limit=10&type=item`;
  const response_test = await fetch(url_test, {
    headers: {
      Accept: "application/json",
      "User-Agent": "PaulinaApp/0.9 (https://gitlab.wikimedia.org/toolforge-repos/paulina)"
    },
  });
  console.log(await response_test.text());
}

The response to this code is:

{"error":"rest-cross-origin-anon-write", "httpCode":403, "httpReason":"Forbidden"}

The same API call works fine when it is called from my local web browser, and also when it is called from my web application using the Python requests module. But when it is called with JavaScript, it responds with the 403 error.

What should have happened instead?:

As this is not a write request, Wikibase REST API should declare that it doesn't need write access, so the request can succeed without the 403 error.

Other information:

A very similar bug was reported 2 years ago for the MediaWiki REST API: T347721

My guess is that the REST API thinks that this is a write request, when in fact it is a read-only request.