digininja/DVWA · error · Error

Network response was not ok

Error message

Network response was not ok

What it means

Same handler pattern as the low level: get_user() fetches GET /vulnerabilities/api/v2/user/2 on page load and throws when the response status is outside 200-299. User id 2 ('morph') is hard-seeded in the UserController constructor, so a 404 from the data layer is unlikely; in practice the non-ok status comes from infrastructure around the router (missing rewrite rules, missing composer vendor) or a mangled URL built from $stripped_url.

Source

Thrown at vulnerabilities/api/source/medium.php:38

					successDiv = document.getElementById ('message');
					successDiv.style.display = 'block';
				} else {
					level = 'user';
				}
				user_info.innerHTML = 'User details: ' + user_json.name + ' (' + level + ')';
				name_input.value = user_json.name;
			}
		}

		function get_user() {
			const url = '" . $stripped_url . "/vulnerabilities/api/v2/user/2';
			 
			fetch(url, { 
					method: 'GET',
				}) 
				.then(response => { 
					if (!response.ok) { 
						throw new Error('Network response was not ok'); 
				} 
				return response.json(); 
				}) 
				.then(data => { 
					update_username (data);
				}) 
				.catch(error => { 
					console.error('There was a problem with your fetch operation:', error); 
			}); 
		}

		function update_name() {
			const url = '" . $stripped_url . "/vulnerabilities/api/v2/user/2';
			const name = document.getElementById ('name').value;
			const data = JSON.stringify({name: name});
			 
			fetch(url, { 
					method: 'PUT', 

View on GitHub (pinned to 5d5c76cced)

Solutions

1. Check the Network tab for the exact status of the /v2/user/2 request.
2. Run composer install in vulnerabilities/api/ if the status is 500 (missing vendor/autoload.php fatal).
3. Enable mod_rewrite/AllowOverride, or add an nginx location rewrite of /vulnerabilities/api/ to public/index.php.
4. Confirm the generated URL ends with /vulnerabilities/api/v2/user/2 (id segment intact, no query string).
5. Test GET /vulnerabilities/api/v2/user/2 directly in the browser; the JSON for user 'morph' should render.

Example fix

// before
if (!response.ok) {
    throw new Error('Network response was not ok');
}
// after
if (!response.ok) {
    throw new Error(`GET user failed: ${response.status} ${response.statusText}`);
}

const url = base + '/vulnerabilities/api/v2/user/2';
if (!/\/vulnerabilities\/api\/v\d+\/user\/\d+$/.test(url)) {
    console.error('Malformed user URL:', url);
    return;
}

function isUser(payload) {
    return typeof payload === 'object' && payload !== null &&
        'name' in payload && 'level' in payload;
}

async function getUserSafe(url) {
    try {
        const response = await fetch(url, { method: 'GET' });
        if (response.status === 404) throw new Error('User not found');
        if (!response.ok) throw new Error(`Request failed: ${response.status}`);
        const data = await response.json();
        if (!isUser(data)) throw new Error('Unexpected payload shape');
        update_username(data);
    } catch (error) {
        console.error('There was a problem with your fetch operation:', error);
    }
}

When it happens

Trigger: Loading /vulnerabilities/api/ at medium level when mod_rewrite/.htaccess is not honored (404 from the web server instead of the router); when vendor/autoload.php is absent so public/index.php fatals with 500; when the request lands on the router but the /2 id segment is lost from the generated URL; or when an HTTP method the controller does not list reaches processRequest() and GenericController('notSupported') answers 405.

Common situations: DVWA deployed without composer install or without mod_rewrite; nginx setups with no equivalent rewrite rule (the shipped .htaccess is Apache-only); URL bases that inject a query string into the fetch target; proxied environments that strip or alter the path.

Related errors

• Network response was not ok
• Network response was not ok
• Network response was not ok
• Decryption failed
• No token passed

AI-assisted analysis of digininja/DVWA@5d5c76cced (2026-08-21). Data as JSON: /api/errors/8c8a299ccfa7233b. Report an issue: GitHub.