Routes can be declared public by setting a flag. And it can be set after routes have been registered with the router. So this can be done using a custom web services plugin. It would use the onBeforeApiRoute event, the same used for declaring routes, so be aware the plugin must be ordered last to work properly.
public function onBeforeApiRoute($router)
{
// Iterate over the routes.
foreach ($router->getRoutes() as $route)
{
// Check that we are altering only GET routes.
if ($route->getMethods() === ['GET'])
{
// Override the public flag.
$defaults = $route->getDefaults();
$defaults['public'] = true;
$route->setDefaults($defaults);
}
}
}
Also keep in mind that this is dangerous and can expose sensitive information, such as user data. Instead of making all routes public you should have a list of routes which you want to make public.
Just to clarify, the above method is for overriding routes added by core or 3rd party plugins and not your own. If you are developing your own web services plugin, you can set the public access when registering the route. When using Joomla\CMS\Router\ApiRouter::createCRUDRoutes() pass the 4th argument to enable public GETs:
$router->createCRUDRoutes(
'v1/foos',
'foos',
['component' => 'com_foos'],
true
);
Or when instantiating the route manually:
$route = new Joomla\Router\Route(['GET'], 'v1/foos', 'foos.doFoos', [], ['public' => true]);
$router->addRoute($route);
