Lighttpd

The following configuration:

$HTTP["remoteip"] !~ "^(...some ipv4 numbers...)" {
  $HTTP["scheme"] == "https" {
    $HTTP["url"] !~ "^/(...some urls ...)" {
      $HTTP["remoteip"] != "one ipv4 subnet" {
        url.access-deny = ( "" )
      }
    }
  }
}

But if I open an URL in Firefox, that reloads itself continously every 60sec (<meta http-equiv="refresh" content="60">), after some time I get a 403.
Forcing a reload in firefox solves the problem and the problem may return. It's not easy to reproduce.

This is lighttpd 1.4.71, I'm sure it existed already in 1.4.70, but I cannot say exactly which version introduced the problem.
All requests are HTTP/2 with TLS.

Looking in the access log I see, that the log line with the return 403 contains an IPv6 address, which explains the 403 decision inside lighttpd. All lines before contain the correct IPv4 address. The user agent of all lines is the same! Some lines before I also see a localhost address (127.0.0.1) with the Firefox user agent, which cannot be correct.

The needed reloads to trigger the problem is at least around 60.

The IPv6 address found belongs to other (dutch) clients on some lighttpd instance (germany) found in the same access log, so I guess lighttpd is mixing up client ips ...