Permission Denied (403) using /batch I have run into a scenario where I am getting an 'Permission Denied' error when attempting to run anything that uses batch, with the sole exception being CRON.

First off, this error is NOT related to the max_allowed_packet issue referred two in every other thread regarding this scenario. First off, my max_allowed_packet is set to 16M, and second, my batch table shows valid requests waiting to be run:

my.cnf:

max_allowed_packet = 16M


drupal.batch table:

15456   ba_Tu-5BZEcFUq3RH37zvx6bvCWJGvlUUtYgADfOlPY 1406048062  ...


The requests being attempted are very small as well, I'm only trying to delete 1 user.

This happens with the primary admin account (UID 1) as well as all other administrators, so it does not appear to be account or access specific.

I am uncertain where to look next for more clues.

MySQL logs do not show any warnings or errors, and the only line in PHP is this:

php drupal: https://www.example.net|1406048063|access denied|X.X.X.X|https://www.example.net/en/batch?op=start&amp;id=15456|https://www.example.net/en/admin/people|1||batch 


IP and Domain censored from above log.

I have also confirmed that there is no '/batch/' folder in my Drupal route that could be messing with the url.

UPDATE

I have continued to investigate this as I do patching and upgrading to my network. As part of this overhaul, the backend DB was just switched from MySQL to PostgreSQL, and the issue persists on both databases. So database can been completely ruled out.

I have had success with disabling 'Clean URLs' in my config. If I disable them all batch operations work as expected, however I cannot leave them disabled for obvious reasons. Disabling them every time is not a great option either, as content admin do not have access to this setting and cannot delete spammers as a result.
I would look at your .htaccess rewrite rules. I've hit instances in the past where batch requests wouldn't fire during updates. Turns out I had custom .htaccess rewrite rules interfering with those requests. 

Based on your example URL, it looks like you're running Drupal in a subdir on the domain. Have you set up the RewriteBase directive for that subdir? Do you have any other custom redirects in .htaccess?