We managed to reproduce this issue only when multiple dots are used in the name, while creating a new webform field. The name of the field is passed on the URL and leads to a 403 forbidden.

This is a server-side limitation, probably via .htaccess (I couldn't find anything nginx specific, so probably it is enforced by BOA as a security measure) and therefore I'm reluctant to change it for such a specific case.

An alternative to still be able to, e.g. add a webform field ending with ... (a common use case) is to first add the field with a simple name (e.g. "hobby"), which will be passed on to the URL and be given as the field key. Then, when editing further details on the field, the name can be changed without problems to any string (e.g. "My favourite hobby is...").