Google App Script loading other page per JS failed

Question

I am trying to load a second page from my google apps script, but as answere I only get a 403.

I have the following doGet:

function doGet(request) {
  Logger.log(Utilities.jsonStringify(request));
  if(!request.parameter.page){
    return HtmlService.createTemplateFromFile('index')
      .evaluate()
      .addMetaTag('viewport', 'width=device-width, initial-scale=1')  //muss NACH .evaluate() stehen
      .setTitle('Essensbestellung');
  }

  return HtmlService.createTemplateFromFile(request.parameter['page'])
      .evaluate()
      .addMetaTag('viewport', 'width=device-width, initial-scale=1')  //muss NACH .evaluate() stehen
      .setTitle('Essensbestellung');
}

And i try to access it using the following Js:

  function loadPage(page) {
     location.assign(page);
  }

How i implemented the function:

<a onclick="loadPage('<?=url?>?page=Settings')">   
   <i class="fa fa-cog" width="25px" height="25px" style="float:right; color:black" ></i>         
</a>

The request and response headings:

Request (left out GET line):

Host: script.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://n-eobd2l2y2c5qsw3ononhxbd5h44jzxq2cgp4laa-1lu-script.googleusercontent.com/
Alt-Used: script.google.com
Connection: keep-alive
Cookie: NID=511=nxjGSpzGLAOy6KQaTFPj8aIRAYLYv2T6zSH-5bTXYLAga1yAkZbl2YLJfDBQa2U5NIxfFio1bXbgXDxJh1107T2iBJCAniYTSPb74R-jl3ZlipvuO-KrRLmLNu5F-pfE1N0w0YA_TdjsP4BpW_pmjnm7YWZRZT8czVEhcyzta4xaYwnnF6QZIVjX4Br101tqBNOB9HdqQffCnoCgNWVA847Oj-U1QQ2n13aQIaGPaYnVeYqdxVQQMTMT7eaHArE4C2ujYXU0Y8i6X4zc6ao6Vz2thZHRh1ALStAWRiZqWxLeLqAipwfvWgZiZFupouK344C4pEuc7k-V0Yq919jINKmcqrxkpuXD0wWrUwE9gdUMHN4y3GWeDQAoRAizzVYm_rD9zanPC9SEbgnb7Gm3RorCWJjZTmif2ZQQ41bb6Y5S6uXZjtR_WhQHRLZGKYK0X7UgpUFS5Q; SID=Jwi3b7rHhjcARjpX7spb82JgxFZQzHdS2cpmzsWAWGN7XylaKFGOm2cm-GBb7Awj9OSONQ.; __Secure-3PSID=Jwi3b7rHhjcARjpX7spb82JgxFZQzHdS2cpmzsWAWGN7XylaCzOV_k-hvNcz5m784IwvNQ.; HSID=Ajx0208boBhKFYy7c; SSID=AAfXj1uaHe3jqyt_Z; APISID=1sbEIreR0lYf4n3U/A83cWkfKygECZRwl3; SAPISID=Pi0-ZVImgtscNcyd/AxR9DirH9lTJHNORH; __Secure-3PAPISID=Pi0-ZVImgtscNcyd/AxR9DirH9lTJHNORH; CONSENT=YES+cb.20220301-11-p0.de+FX+583; SIDCC=AJi4QfG8QSw0ZeFwLss5BMLUKDQoZbDP73qZsvhHRIVVAzBSDbI96aHFl760-a_PsIctXEMzsJE; __Secure-3PSIDCC=AJi4QfEj3v09I499v19fnAmr3QjRy0Y5bciIUcIpsvFUXWJuOpV63crZSoW1HPzRTVAwVko6Nsg; 1P_JAR=2022-05-16-08; __Secure-1PSID=Jwi3b7rHhjcARjpX7spb82JgxFZQzHdS2cpmzsWAWGN7XylattERwvp_KlTbTr0mQ56Grw.; __Secure-1PAPISID=Pi0-ZVImgtscNcyd/AxR9DirH9lTJHNORH; __Secure-1PSIDCC=AJi4QfFGrad2iGVm1B3XIgB8G4R1gzE6pD5rWxHNr8n7s62Nu7nVJMr5bnwnpJnLYDptFbMVgg; ANID=AHWqTUkUvcGtAP2Cu8n7qTfK58zTwUDbg4KwLmNr9edlxNPDvTyVUQKOM8oG9b7n; OTZ=6497670_48_52_123900_48_436380
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
TE: trailers

Response:

HTTP/3 403 Forbidden
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 16 May 2022 08:17:44 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=UTF-8
content-security-policy: script-src 'nonce-5uK2tWwJ2lmamgKL4h/9pQ' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 117
server: GSE
set-cookie: SIDCC=AJi4QfFCoQV2p1eoOONG3z-tQ8ZZLws-oD2yfERpNmsLmpGPyQPPl5uD9zHw3i5wgucbpLjl4bw; expires=Tue, 16-May-2023 08:17:44 GMT; path=/; domain=.google.com; priority=high
set-cookie: __Secure-3PSIDCC=AJi4QfGEosjtJo8oJjPuwDpOzn4rsZ519EjMpFUihxLAyf5zBSrKAtOPA3yanxCtBJ6uuqvXOoU; expires=Tue, 16-May-2023 08:17:44 GMT; path=/; domain=.google.com; Secure; HttpOnly; priority=high; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Answer 1

Try this:

<a onclick="loadPage('<?=url?>?page=Settings')">   

<script>
  function loadPage(page) {
    window.top.location.replace(page)
  }
</script>