403: Forbidden

Did you get this message when sending a test mail? What value does res_id have in the url? When this value equals 0 it means that it is not linked to a medium_id in the database. This happens when you send a test email. You could try to create test mailing with a mailing list that includes your test email address only and send this one. You should now be able to use the unsubscribe link.

@http.route(['/mail/mailing//unsubscribe'], type='http', website=True, auth='public')
def mailing(self, mailing_id, email=None, res_id=None, token="", **post):
    mailing = request.env['mailing.mailing'].sudo().browse(mailing_id)
    if mailing.exists():
        res_id = res_id and int(res_id)
        if not self._valid_unsubscribe_token(mailing_id, res_id, email, str(token)):
            raise exceptions.AccessDenied()

def _valid_unsubscribe_token(self, mailing_id, res_id, email, token):
    if not (mailing_id and res_id and email and token):
        return False
    mailing = request.env['mailing.mailing'].sudo().browse(mailing_id)
    return consteq(mailing._unsubscribe_token(res_id, email), token)

def _unsubscribe_token(self, res_id, email):
    """Generate a secure hash for this mailing list and parameters.

    This is appended to the unsubscription URL and then checked at
    unsubscription time to ensure no malicious unsubscriptions are
    performed.

    :param int res_id:
        ID of the resource that will be unsubscribed.

    :param str email:
        Email of the resource that will be unsubscribed.
    """
    secret = self.env["ir.config_parameter"].sudo().get_param("database.secret")
    token = (self.env.cr.dbname, self.id, int(res_id), tools.ustr(email))
    return hmac.new(secret.encode('utf-8'), repr(token).encode('utf-8'), hashlib.sha512).hexdigest()

This is the code that raises the AccessDenied exeption from the mass_mailing controller and model.

I hope this helps!