`GET /_matrix/client/v3/profile/...` states it do not require auth, but implementations can require auth

[Half-Shot]

Link to problem area:

https://spec.matrix.org/v1.16/client-server-api/#get_matrixclientv3profileuserid

Issue

The spec says mentions that authentication is not required for the endpoint, but Synapse for example may gate the endpoint behind auth.

This really makes a lot of sense. You may not want people to enumerate your user ids, nor do driveby requests for your profile data if you do not share a room. I think the spec should be clear that authentication may be required,

[Half-Shot]

Related to matrix-org/matrix-spec-proposals#2949 ?

EDIT: And matrix-org/synapse#9006

[turt2live]

we probably need to clarify on endpoints whether "Requires authentication: no" means "don't have any authentication" or "authentication is optional".

[KitsuneRal]

FWIW, OpenAPI Specification 3.0.3 added an example for the case where authentication is optional.