In our setup we have a dispatcher instance in front of our author instance. We have a component with a mutifield and the author is allowed to fill in an external url if they want to. When they for example choose https://www.google.com:

It returns a 403 error.
When we pass www.google.com it does work:

We have the following configuration set:
#Allow posts content, etc and servlets
/0007 { /type "allow" /glob "POST /content*"}
The weird thing is that this only happens when those values are stored within a multifield item, for example another component we have doesn't show this behavior. NOTE: in this component the data is not stored in a multifield item:

None of the 403 errors happen when we access the author instance directly, without a dispatcher in between.