Access denied for a list with unique permission items on browser back action

Question

We have a SharePoint 2019 subsite in which we deployed some SPFx webpart solutions and event receivers. The SPFx only target editing single items.

Mostly everything is fine, but sometimes, when navigating back (through browser history or via programmed button that uses history.back()) we get an “access denied” message. This only happens when going back to list views. As SharePoint redirects to the AccessDenied.aspx, a second back-action (sometimes with a fast F5 neccessary) opens the list page without problems. The behavior is not depending on a specific user and occurs for site collection administrators, too. Network tab in the browser dev tools only show the normal wsaUpload.ashx access denied messages, as CEIP is disabled. There also is an error regarding following, but this is present, too, in successful accesses to the page. ULS log did not provide helpful messages, either.

Did anyone of you experience a similar behavior and/or can give me a hint where and what to look into?

Answer 1

After opening a case with Microsoft, and an analysis of ULS- and Fiddler-logs Microsoft proposed to switch off "Web Page Securitiy Validation" for the affected web application. This resolved the issue.

We still cannot say anything about the cause of this behaviour and it only occurs with the SP2019 Environments with this customer.