Sporadic permissions issue We are running a Drupal 8 site with 400 or so pages of content. 

We have a number of "resource pages" were views generate links to content by topic area. Here is an example of one of those pages. 

In general everything is working as intended, however, sporadically we have an issue with clean URLs and the link to content in those views. Specifically, index.php is added to the link presented only to anonymous users. For example, website/mypage becomes website/index.php/mypage, or even website/index.php/index.php/mypage.

This problem never occurs for logged in users, only anonymous users. It is also not consistent. It may happen to 2-3 of the links in a single view, or several across the views on the same page but generally will not affect the entire site or page. It may not happen for weeks and then 4-5 times in 24 hours. In the last few days it appears to be happening every few hours.  

It appears to mostly only happen on resource pages (they are a content type) like the one I linked above. We have also some times observed it occurring on other menu links. These links usually still work however...

We have been unable to find a reason for it. Clearing the site cache a few times does fix the issue but it is somewhat unacceptable that this happens regularly.

The views on those specific pages do make use of relationships and aggregation  to generate their content. Several also use re-write rules to generate custom link text. The issue appears to affect both types of views on those pages.

Can anyone suggest what the cause of such an issue could be or give any ideas as to how to stop it occurring?
How this gets started is hard to tell. But once it does it spreads quickly. When a user clicks on a link with /index.php the page will include /index.php in the base url, which then is used for all links generated on this page. The same is the case for search bots, once they hit a link with /index.php they will crawl the whole site with it.

To stop this, redirect the unclean urls. You could use this core patch or Redirect, but as long as the core patch is not committed and the module is not released, you can do this in .htaccess. Place these two lines at the top of the rewrite rules:

# Various rewrite rules.
&lt;IfModule mod_rewrite.c&gt;
  RewriteEngine on

  RewriteCond %{THE_REQUEST} "^[A-Z]{3,9}\ /index\.php(.+)\sHTTP" [NC]
  RewriteRule "^" "%1" [R=301,NE,L]