{"record":{"id":"90176c2471b9e0ae","repo":"digininja/DVWA","slug":"network-response-was-not-ok-90176c","errorCode":null,"errorMessage":"Network response was not ok","messagePattern":"Network response was not ok","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"vulnerabilities/cryptography/source/impossible.php","lineNumber":27,"sourceCode":"$html = \"\n\t<script>\n\t\tfunction send_token() {\n\n\t\t\tconst url = 'source/check_token_impossible.php';\n\t\t\tconst data = document.getElementById ('token').value;\n\n\t\t\tconsole.log (data);\n\t\t\t \n\t\t\tfetch(url, { \n\t\t\t\t\tmethod: 'POST', \n\t\t\t\t\theaders: { \n\t\t\t\t\t\t'Content-Type': 'application/json' \n\t\t\t\t\t}, \n\t\t\t\t\tbody: data\n\t\t\t\t}) \n\t\t\t\t.then(response => { \n\t\t\t\t\tif (!response.ok) { \n\t\t\t\t\t\tthrow new Error('Network response was not ok'); \n\t\t\t\t} \n\t\t\t\treturn response.json(); \n\t\t\t\t}) \n\t\t\t\t.then(data => { \n\t\t\t\t\tconsole.log(data);\n\t\t\t\t\tmessage_line = document.getElementById ('message');\n\t\t\t\t\tif (data.status == 200) {\n\t\t\t\t\t\tmessage_line.innerText = 'Welcome back ' + data.user + ' (' + data.level + ')';\n\t\t\t\t\t\tmessage_line.setAttribute('class', 'success');\n\t\t\t\t\t} else {\n\t\t\t\t\t\tmessage_line.innerText = 'Error: ' + data.message;\n\t\t\t\t\t\tmessage_line.setAttribute('class', 'warning');\n\t\t\t\t\t}\n\t\t\t\t}) \n\t\t\t\t.catch(error => { \n\t\t\t\t\tconsole.error('There was a problem with your fetch operation:', error); \n\t\t\t}); \n","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/digininja/DVWA/blob/5d5c76cced604e54462b13723f5c69af58e78748/vulnerabilities/cryptography/source/impossible.php#L9-L45","documentation":"Identical handler to the high level, but POSTing to source/check_token_impossible.php. That script also returns HTTP 200 for every logical outcome (wrong token shape, tampering, success) by putting the status code in the JSON body, so this Error only fires on transport/server failures: 404 for an unresolvable relative URL, 405/500 for server-level rejection or a PHP fatal, or proxy errors.","triggerScenarios":"Clicking Submit on the impossible-level page when the page URL depth makes 'source/check_token_impossible.php' resolve to a missing file (404); a fatal in the required token_library_impossible.php (for example aes-256-gcm unavailable in the OpenSSL build) producing 500; a proxy in front returning 502/503.","commonSituations":"Module reached via a rewritten/aliased URL so the relative path breaks; OpenSSL builds compiled without GCM support; directory renames; servers that answer 405 to POSTs on static-looking paths.","solutions":["Verify the POST status in the Network tab - anything other than 200 means the request failed before token validation.","Load /vulnerabilities/cryptography/source/check_token_impossible.php directly to confirm the file resolves.","Check the PHP error log for fatals and confirm openssl_decrypt supports aes-256-gcm (openssl_get_cipher_methods()).","Switch the fetch to an absolute URL anchored at the application root."],"exampleFix":"// before\nconst url = 'source/check_token_impossible.php';\n// after\nconst url = '/vulnerabilities/cryptography/source/check_token_impossible.php';","handlingStrategy":"try-catch","validationCode":"function validTokenSubmission(text) {\n    try {\n        const o = JSON.parse(text);\n        return typeof o === 'object' && o !== null && 'token' in o && 'iv' in o;\n    } catch {\n        return false;\n    }\n}\n// guard inside send_token() before the fetch\nif (!validTokenSubmission(data)) {\n    document.getElementById('message').innerText = 'Token must be JSON with token and iv fields';\n    return;\n}","typeGuard":"function isTokenCheckResponse(payload) {\n    return typeof payload === 'object' && payload !== null &&\n        'status' in payload && (payload.status === 200 || 'message' in payload);\n}","tryCatchPattern":"async function sendTokenSafe() {\n    try {\n        const response = await fetch(url, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/json' },\n            body: document.getElementById('token').value\n        });\n        if (!response.ok) throw new Error(`Endpoint unreachable: ${response.status}`);\n        const data = await response.json();\n        if (!isTokenCheckResponse(data)) throw new Error('Unexpected response shape');\n        render(data);\n    } catch (error) {\n        console.error('There was a problem with your fetch operation:', error);\n    }\n}","preventionTips":["Anchor endpoint URLs at the application root rather than relative to the current page.","Validate the JSON envelope client-side before POSTing.","Confirm the PHP runtime supports the cipher (openssl_get_cipher_methods() includes aes-256-gcm) during deployment checks."],"tags":["javascript","fetch","http-status","cryptography","token","dvwa"],"backgroundTag":"http-error-status","analyzedSha":"5d5c76cced604e54462b13723f5c69af58e78748","analyzedAt":"2026-08-21T01:20:26.904Z","schemaVersion":2},"datasetVersion":"2026-08-21T03:17:12.404Z"}