GET /client/publicRooms is marked as not requiring auth, despite Synapse requiring it by default.

[Kladki]

GET /_matrix/client/v3/publicRooms claims to not require authentication, despite Synapse requiring authentication by default.

Note: POST /_matrix/client/v3/publicRooms on the other hand does require authentication.

[girlbossceo]

On Synapse, it was done for security purposes and is why conduwuit also requires authentication on these endpoints.

https://matrix.org/blog/2019/11/09/avoiding-unwelcome-visitors-on-private-matrix-servers/

[Kladki]

Yep, that makes sense. The problem is that it is behaviour that is not in the spec, and should be added.