I have been working on a WeChat public account recently, and there is also a need for WeChat authorization. However, maybe because I am on the first-level page, I authorize it directly after entering, so your problem is not exposed. Here are some personal opinions, there must be shortcomings, please correct me:
First of all: WeChat’s back button is directly related to the history of its browser. In my case, it is authorized directly after entering the first-level page. Then if the user directly clicks back, it will achieve the effect of "closing the page and displaying the main menu". I have tried several methods, including:

"Listen for return events"

window.addEventListener("popstate", function()
{
    //监听到后执行的代码
},false);

"After authorized login, use the history built-in method"

window.history.go(-1);
或
window.history.back

However, there have been many situations where the WeChat WEB developer tool works, but not on the mobile version; or it works at the time, but fails again after two days.
Solution: In the end, I still used the new features of h5

//替换(用null模拟删除)url记录，实现返回一级页面 直接关闭
window.history.replaceState(null, null, toUrl);

It is equivalent to leaving the login interface record blank in the browser history.
You can try this, it may be useful to you,,,,

In fact, in WeChat, everythingauthorized on demand is rogue; the experienceis extremely poor.