In our setup we have a dispatcher instance in front of our author instance. We have a component with a mutifield and the author is allowed to fill in an external url if they want to. When they for example choose https://www.google.com:
The weird thing is that this only happens when those values are stored within a multifield item, for example another component we have doesn't show this behavior. NOTE: in this component the data is not stored in a multifield item:
None of the 403 errors happen when we access the author instance directly, without a dispatcher in between.