I had a problem that left me scratching my head for 2 hours here. So I'm posting what I was doing wrong and how I solved it. In case someone else makes the same mistake and stumbles upon this post.
So I'm new to testing and codeception, so I was trying to set an acceptance login test. I was getting 403 error from the framework after clicking the login button during the test, something that wasn't happening during live testing. Looking into the header one thing struck me weird and that was Sec-Fetch-Site cross-site. So I went digging into the docs.
I had set the WebDriver url as the loopback address (127.0.0.1) instead of localhost in codeception.yml. I guess as a learner I learned from my own mistake so make sure that framework baseurl and WebDriver url match.