.sisyphus/evidence/final-qa/s56-xss-attempt.json

{"id":"45ba7e74-889a-4ae1-b375-9c03145409a6","title":"<script>alert(\"XSS\")</script>","description":"XSS test","status":"Open","assigneeId":null,"createdById":"0fae5846-067b-4671-9eb9-d50d21d18dfe","clubId":"00000000-0000-0000-0000-000000000000","dueDate":"2026-03-20T23:59:59+00:00","createdAt":"2026-03-05T20:10:56.708224+00:00","updatedAt":"2026-03-05T20:10:56.708224+00:00"}
HTTP:201
fix: exempt /api/clubs/me from tenant validation - Add path exemption in TenantValidationMiddleware for /api/clubs/me - Change authorization policy from RequireMember to RequireViewer - Fix KEYCLOAK_CLIENT_ID in docker-compose.yml (workclub-app not workclub-api) - Endpoint now works without X-Tenant-Id header as intended - Other endpoints still protected by tenant validation This fixes the chicken-and-egg problem where frontend needs to call /api/clubs/me to discover available clubs before selecting a tenant. 2026-03-05 21:32:37 +01:00			`{"id":"45ba7e74-889a-4ae1-b375-9c03145409a6","title":"<script>alert(\"XSS\")</script>","description":"XSS test","status":"Open","assigneeId":null,"createdById":"0fae5846-067b-4671-9eb9-d50d21d18dfe","clubId":"00000000-0000-0000-0000-000000000000","dueDate":"2026-03-20T23:59:59+00:00","createdAt":"2026-03-05T20:10:56.708224+00:00","updatedAt":"2026-03-05T20:10:56.708224+00:00"}`
			`HTTP:201`