I have several projects set to public. When a user access the URL to the timelines, OpenProject challenges for credentials as seen in the image below. The user can hit cancel and then see the timeline, but why is it asking for credentials?
I launched a new fresh OpenProject, created a project and a timeline report but I have not been able to reproduce your issue. Did you install any plugin or modified any setting in OpenProject or your server that could be related to that issue?