{"record":{"id":"d9e485d57e86a18c","repo":"digininja/DVWA","slug":"network-response-was-not-ok-d9e485","errorCode":null,"errorMessage":"Network response was not ok","messagePattern":"Network response was not ok","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"vulnerabilities/cryptography/source/high.php","lineNumber":27,"sourceCode":"$html = \"\n\t<script>\n\t\tfunction send_token() {\n\n\t\t\tconst url = 'source/check_token_high.php';\n\t\t\tconst data = document.getElementById ('token').value;\n\n\t\t\tconsole.log (data);\n\t\t\t \n\t\t\tfetch(url, { \n\t\t\t\t\tmethod: 'POST', \n\t\t\t\t\theaders: { \n\t\t\t\t\t\t'Content-Type': 'application/json' \n\t\t\t\t\t}, \n\t\t\t\t\tbody: data\n\t\t\t\t}) \n\t\t\t\t.then(response => { \n\t\t\t\t\tif (!response.ok) { \n\t\t\t\t\t\tthrow new Error('Network response was not ok'); \n\t\t\t\t} \n\t\t\t\treturn response.json(); \n\t\t\t\t}) \n\t\t\t\t.then(data => { \n\t\t\t\t\tconsole.log(data);\n\t\t\t\t\tmessage_line = document.getElementById ('message');\n\t\t\t\t\tif (data.status == 200) {\n\t\t\t\t\t\tmessage_line.innerText = 'Welcome back ' + data.user + ' (' + data.level + ')';\n\t\t\t\t\t\tmessage_line.setAttribute('class', 'success');\n\t\t\t\t\t} else {\n\t\t\t\t\t\tmessage_line.innerText = 'Error: ' + data.message;\n\t\t\t\t\t\tmessage_line.setAttribute('class', 'warning');\n\t\t\t\t\t}\n\t\t\t\t}) \n\t\t\t\t.catch(error => { \n\t\t\t\t\tconsole.error('There was a problem with your fetch operation:', error); \n\t\t\t}); \n","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/digininja/DVWA/blob/5d5c76cced604e54462b13723f5c69af58e78748/vulnerabilities/cryptography/source/high.php#L9-L45","documentation":"Client-side guard on the fetch that POSTs the token textarea to the relative URL source/check_token_high.php. That endpoint always answers HTTP 200 with a JSON envelope (status 200 or 521-527 carried inside the body, never as an HTTP status), so 'Network response was not ok' means the request never reached working PHP: 404 when the relative path does not resolve to the file, or 500 on a server-side fatal such as a missing openssl extension before any output.","triggerScenarios":"Calling send_token() from a page whose URL is not /vulnerabilities/cryptography/index.php, so the relative 'source/check_token_high.php' resolves to a non-existent path (404); a PHP fatal (ext-openssl absent, parse error in the required token_library_high.php) returning 500; a reverse proxy replying 502/503 while PHP is down.","commonSituations":"Accessing the module through an alias, rewrite, or nested path that changes relative-URL resolution; hardened PHP images without ext-openssl; moving or renaming the source/ directory; API gateways in front of the app that block direct POSTs to .php files.","solutions":["In the Network tab, confirm the POST target and its status (the body of a 200 always parses; a 4xx/5xx here is transport, not token logic).","Open the POST URL directly in the browser to see whether it 404s; if so, anchor it to the app root.","Check the PHP error log and enable ext-openssl if the status is 500.","Use an absolute path for the fetch URL instead of a relative one."],"exampleFix":"// before\nconst url = 'source/check_token_high.php';\n// after\nconst url = '/vulnerabilities/cryptography/source/check_token_high.php';","handlingStrategy":"try-catch","validationCode":"function validTokenSubmission(text) {\n    try {\n        const o = JSON.parse(text);\n        return typeof o === 'object' && o !== null && 'token' in o && 'iv' in o;\n    } catch {\n        return false;\n    }\n}\n// guard inside send_token() before the fetch\nif (!validTokenSubmission(data)) {\n    document.getElementById('message').innerText = 'Token must be JSON with token and iv fields';\n    return;\n}","typeGuard":"function isTokenCheckResponse(payload) {\n    return typeof payload === 'object' && payload !== null &&\n        'status' in payload && (payload.status === 200 || 'message' in payload);\n}","tryCatchPattern":"async function sendTokenSafe() {\n    try {\n        const response = await fetch(url, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/json' },\n            body: document.getElementById('token').value\n        });\n        if (!response.ok) throw new Error(`Endpoint unreachable: ${response.status}`);\n        const data = await response.json();\n        if (!isTokenCheckResponse(data)) throw new Error('Unexpected response shape');\n        render(data);\n    } catch (error) {\n        console.error('There was a problem with your fetch operation:', error);\n    }\n}","preventionTips":["Use absolute URLs for endpoint scripts so page relocation cannot break the relative path.","Parse the textarea as JSON client-side before POSTing to fail fast with a clear message.","Remember this endpoint signals errors in the body's status field with HTTP 200 - branch on data.status, not just response.ok."],"tags":["javascript","fetch","http-status","cryptography","token","dvwa"],"backgroundTag":"http-error-status","analyzedSha":"5d5c76cced604e54462b13723f5c69af58e78748","analyzedAt":"2026-08-21T01:20:26.904Z","schemaVersion":2},"datasetVersion":"2026-08-21T03:17:12.404Z"}