Thank you for reply. I found the reason is inside my backend.
My backend is using Tomcat, one of the tomcat filters is designed for handle CORS request, it named: org.apache.catalina.filters.CorsFilter, it has a design flaw in handling the “Origin” send from ionic, the $http sends “file:///” as the value of header “Origin”, however, CorsFilter can not recognize the “file:///”, it is expecting an URL start with “http://” or “https://”, so marked the request from ionic app as an invalid request, then response with 403.
I have to re-write the CrosFilter in Tomcat to handle Origin header from ionic.