{"record":{"id":"8c8a299ccfa7233b","repo":"digininja/DVWA","slug":"network-response-was-not-ok-8c8a29","errorCode":null,"errorMessage":"Network response was not ok","messagePattern":"Network response was not ok","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"vulnerabilities/api/source/medium.php","lineNumber":38,"sourceCode":"\t\t\t\t\tsuccessDiv = document.getElementById ('message');\n\t\t\t\t\tsuccessDiv.style.display = 'block';\n\t\t\t\t} else {\n\t\t\t\t\tlevel = 'user';\n\t\t\t\t}\n\t\t\t\tuser_info.innerHTML = 'User details: ' + user_json.name + ' (' + level + ')';\n\t\t\t\tname_input.value = user_json.name;\n\t\t\t}\n\t\t}\n\n\t\tfunction get_user() {\n\t\t\tconst url = '\" . $stripped_url . \"/vulnerabilities/api/v2/user/2';\n\t\t\t \n\t\t\tfetch(url, { \n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t}) \n\t\t\t\t.then(response => { \n\t\t\t\t\tif (!response.ok) { \n\t\t\t\t\t\tthrow new Error('Network response was not ok'); \n\t\t\t\t} \n\t\t\t\treturn response.json(); \n\t\t\t\t}) \n\t\t\t\t.then(data => { \n\t\t\t\t\tupdate_username (data);\n\t\t\t\t}) \n\t\t\t\t.catch(error => { \n\t\t\t\t\tconsole.error('There was a problem with your fetch operation:', error); \n\t\t\t}); \n\t\t}\n\n\t\tfunction update_name() {\n\t\t\tconst url = '\" . $stripped_url . \"/vulnerabilities/api/v2/user/2';\n\t\t\tconst name = document.getElementById ('name').value;\n\t\t\tconst data = JSON.stringify({name: name});\n\t\t\t \n\t\t\tfetch(url, { \n\t\t\t\t\tmethod: 'PUT', ","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/digininja/DVWA/blob/5d5c76cced604e54462b13723f5c69af58e78748/vulnerabilities/api/source/medium.php#L20-L56","documentation":"Same handler pattern as the low level: get_user() fetches GET /vulnerabilities/api/v2/user/2 on page load and throws when the response status is outside 200-299. User id 2 ('morph') is hard-seeded in the UserController constructor, so a 404 from the data layer is unlikely; in practice the non-ok status comes from infrastructure around the router (missing rewrite rules, missing composer vendor) or a mangled URL built from $stripped_url.","triggerScenarios":"Loading /vulnerabilities/api/ at medium level when mod_rewrite/.htaccess is not honored (404 from the web server instead of the router); when vendor/autoload.php is absent so public/index.php fatals with 500; when the request lands on the router but the /2 id segment is lost from the generated URL; or when an HTTP method the controller does not list reaches processRequest() and GenericController('notSupported') answers 405.","commonSituations":"DVWA deployed without composer install or without mod_rewrite; nginx setups with no equivalent rewrite rule (the shipped .htaccess is Apache-only); URL bases that inject a query string into the fetch target; proxied environments that strip or alter the path.","solutions":["Check the Network tab for the exact status of the /v2/user/2 request.","Run composer install in vulnerabilities/api/ if the status is 500 (missing vendor/autoload.php fatal).","Enable mod_rewrite/AllowOverride, or add an nginx location rewrite of /vulnerabilities/api/ to public/index.php.","Confirm the generated URL ends with /vulnerabilities/api/v2/user/2 (id segment intact, no query string).","Test GET /vulnerabilities/api/v2/user/2 directly in the browser; the JSON for user 'morph' should render."],"exampleFix":"// before\nif (!response.ok) {\n    throw new Error('Network response was not ok');\n}\n// after\nif (!response.ok) {\n    throw new Error(`GET user failed: ${response.status} ${response.statusText}`);\n}","handlingStrategy":"try-catch","validationCode":"const url = base + '/vulnerabilities/api/v2/user/2';\nif (!/\\/vulnerabilities\\/api\\/v\\d+\\/user\\/\\d+$/.test(url)) {\n    console.error('Malformed user URL:', url);\n    return;\n}","typeGuard":"function isUser(payload) {\n    return typeof payload === 'object' && payload !== null &&\n        'name' in payload && 'level' in payload;\n}","tryCatchPattern":"async function getUserSafe(url) {\n    try {\n        const response = await fetch(url, { method: 'GET' });\n        if (response.status === 404) throw new Error('User not found');\n        if (!response.ok) throw new Error(`Request failed: ${response.status}`);\n        const data = await response.json();\n        if (!isUser(data)) throw new Error('Unexpected payload shape');\n        update_username(data);\n    } catch (error) {\n        console.error('There was a problem with your fetch operation:', error);\n    }\n}","preventionTips":["Branch on response.status (404 vs 422 vs 500) before throwing so users get a meaningful message.","Keep the generated URL free of query-string fragments from the page request.","Ensure composer dependencies and rewrite rules exist before the page auto-fetches on load."],"tags":["javascript","fetch","http-status","rest-api","dvwa"],"backgroundTag":"http-error-status","analyzedSha":"5d5c76cced604e54462b13723f5c69af58e78748","analyzedAt":"2026-08-21T01:20:26.904Z","schemaVersion":2},"datasetVersion":"2026-08-21T03:17:12.404Z"}