What happened

GET /krill-token returned the PIN-derived cluster bearer token — the credential that authenticates every mutating endpoint (node create/invoke/ delete, backup restore, shutdown) — to any caller, with no authenticate {} wrapper. Found during the public-demo exposure audit (krill#915); demo mode already hard-blocks the route, but a normal (non-demo) server on any reachable network served the cluster credential to whoever asked.

Root cause

The route’s own comment explained the reasoning: “Unauthenticated — the WASM app is already trusted (served from the same server).” That assumption only holds if the request truly originates from the same machine the server runs on; Ktor gives the route no way to verify that, and on a LAN- or internet-reachable server the request is just another client. The endpoint also had no actual consumer — WasmClientPinStore.setServerToken(), the only call site referenced in its doc comment, was never invoked anywhere in the codebase.

Fix

• Removed GET /krill-token from server/.../Routes.kt entirely, along with the now-unused pinProvider parameter threaded through configureApiRoutes → configureSystemRoutes and Server.kt’s module wiring.
• Removed the dead WasmClientPinStore.setServerToken() helper (shared/.../security/WasmClientPinStore.kt) and its doc comment referencing the endpoint — nothing called it.
• Added KrillTokenRouteRemovedTest (server/src/jvmTest/.../Routes package) asserting the route string is gone from Routes.kt, so it can’t silently come back.

Prevention

• An “unauthenticated because same-origin” comment on a network-facing route is a claim the framework isn’t enforcing. Ktor has no built-in concept of “same machine as the server process” — if that’s the intended guarantee, it needs an explicit loopback/socket check, not a comment.
• Dead code that also happens to be a live vulnerability should be deleted, not gated. /krill-token had no client consumer; adding a same-host check would have preserved a security surface nothing used. Removing it converts “unused and dangerous” into “gone,” and any future WASM-kiosk token bootstrap can be designed with a real same-host guarantee from scratch.
• A full testApplication harness isn’t usable in :server:jvmTest today — the pinned ktor-server-tests:2.3.13 test classpath throws NoClassDefFoundError against this module’s ktor-server-core 3.4.x application/environment API. Route-removal regressions in this module need a source-level guard until that gap is closed.