digininja/DVWA · error · Error

Network response was not ok

Error message

Network response was not ok

What it means

Identical handler to the high level, but POSTing to source/check_token_impossible.php. That script also returns HTTP 200 for every logical outcome (wrong token shape, tampering, success) by putting the status code in the JSON body, so this Error only fires on transport/server failures: 404 for an unresolvable relative URL, 405/500 for server-level rejection or a PHP fatal, or proxy errors.

Source

Thrown at vulnerabilities/cryptography/source/impossible.php:27

$html = "
	<script>
		function send_token() {

			const url = 'source/check_token_impossible.php';
			const data = document.getElementById ('token').value;

			console.log (data);
			 
			fetch(url, { 
					method: 'POST', 
					headers: { 
						'Content-Type': 'application/json' 
					}, 
					body: data
				}) 
				.then(response => { 
					if (!response.ok) { 
						throw new Error('Network response was not ok'); 
				} 
				return response.json(); 
				}) 
				.then(data => { 
					console.log(data);
					message_line = document.getElementById ('message');
					if (data.status == 200) {
						message_line.innerText = 'Welcome back ' + data.user + ' (' + data.level + ')';
						message_line.setAttribute('class', 'success');
					} else {
						message_line.innerText = 'Error: ' + data.message;
						message_line.setAttribute('class', 'warning');
					}
				}) 
				.catch(error => { 
					console.error('There was a problem with your fetch operation:', error); 
			}); 

View on GitHub (pinned to 5d5c76cced)

Solutions

1. Verify the POST status in the Network tab - anything other than 200 means the request failed before token validation.
2. Load /vulnerabilities/cryptography/source/check_token_impossible.php directly to confirm the file resolves.
3. Check the PHP error log for fatals and confirm openssl_decrypt supports aes-256-gcm (openssl_get_cipher_methods()).
4. Switch the fetch to an absolute URL anchored at the application root.

Example fix

// before
const url = 'source/check_token_impossible.php';
// after
const url = '/vulnerabilities/cryptography/source/check_token_impossible.php';

function validTokenSubmission(text) {
    try {
        const o = JSON.parse(text);
        return typeof o === 'object' && o !== null && 'token' in o && 'iv' in o;
    } catch {
        return false;
    }
}
// guard inside send_token() before the fetch
if (!validTokenSubmission(data)) {
    document.getElementById('message').innerText = 'Token must be JSON with token and iv fields';
    return;
}

function isTokenCheckResponse(payload) {
    return typeof payload === 'object' && payload !== null &&
        'status' in payload && (payload.status === 200 || 'message' in payload);
}

async function sendTokenSafe() {
    try {
        const response = await fetch(url, {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: document.getElementById('token').value
        });
        if (!response.ok) throw new Error(`Endpoint unreachable: ${response.status}`);
        const data = await response.json();
        if (!isTokenCheckResponse(data)) throw new Error('Unexpected response shape');
        render(data);
    } catch (error) {
        console.error('There was a problem with your fetch operation:', error);
    }
}

When it happens

Trigger: Clicking Submit on the impossible-level page when the page URL depth makes 'source/check_token_impossible.php' resolve to a missing file (404); a fatal in the required token_library_impossible.php (for example aes-256-gcm unavailable in the OpenSSL build) producing 500; a proxy in front returning 502/503.

Common situations: Module reached via a rewritten/aliased URL so the relative path breaks; OpenSSL builds compiled without GCM support; directory renames; servers that answer 405 to POSTs on static-looking paths.

Related errors

• Network response was not ok
• Network response was not ok
• Network response was not ok
• Decryption failed
• Could not decode JSON object.

AI-assisted analysis of digininja/DVWA@5d5c76cced (2026-08-21). Data as JSON: /api/errors/90176c2471b9e0ae. Report an issue: GitHub.