digininja/DVWA · error · Error

Network response was not ok

Error message

Network response was not ok

What it means

Client-side guard on the fetch that POSTs the token textarea to the relative URL source/check_token_high.php. That endpoint always answers HTTP 200 with a JSON envelope (status 200 or 521-527 carried inside the body, never as an HTTP status), so 'Network response was not ok' means the request never reached working PHP: 404 when the relative path does not resolve to the file, or 500 on a server-side fatal such as a missing openssl extension before any output.

Source

Thrown at vulnerabilities/cryptography/source/high.php:27

$html = "
	<script>
		function send_token() {

			const url = 'source/check_token_high.php';
			const data = document.getElementById ('token').value;

			console.log (data);
			 
			fetch(url, { 
					method: 'POST', 
					headers: { 
						'Content-Type': 'application/json' 
					}, 
					body: data
				}) 
				.then(response => { 
					if (!response.ok) { 
						throw new Error('Network response was not ok'); 
				} 
				return response.json(); 
				}) 
				.then(data => { 
					console.log(data);
					message_line = document.getElementById ('message');
					if (data.status == 200) {
						message_line.innerText = 'Welcome back ' + data.user + ' (' + data.level + ')';
						message_line.setAttribute('class', 'success');
					} else {
						message_line.innerText = 'Error: ' + data.message;
						message_line.setAttribute('class', 'warning');
					}
				}) 
				.catch(error => { 
					console.error('There was a problem with your fetch operation:', error); 
			}); 

View on GitHub (pinned to 5d5c76cced)

Solutions

1. In the Network tab, confirm the POST target and its status (the body of a 200 always parses; a 4xx/5xx here is transport, not token logic).
2. Open the POST URL directly in the browser to see whether it 404s; if so, anchor it to the app root.
3. Check the PHP error log and enable ext-openssl if the status is 500.
4. Use an absolute path for the fetch URL instead of a relative one.

Example fix

// before
const url = 'source/check_token_high.php';
// after
const url = '/vulnerabilities/cryptography/source/check_token_high.php';

function validTokenSubmission(text) {
    try {
        const o = JSON.parse(text);
        return typeof o === 'object' && o !== null && 'token' in o && 'iv' in o;
    } catch {
        return false;
    }
}
// guard inside send_token() before the fetch
if (!validTokenSubmission(data)) {
    document.getElementById('message').innerText = 'Token must be JSON with token and iv fields';
    return;
}

function isTokenCheckResponse(payload) {
    return typeof payload === 'object' && payload !== null &&
        'status' in payload && (payload.status === 200 || 'message' in payload);
}

async function sendTokenSafe() {
    try {
        const response = await fetch(url, {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: document.getElementById('token').value
        });
        if (!response.ok) throw new Error(`Endpoint unreachable: ${response.status}`);
        const data = await response.json();
        if (!isTokenCheckResponse(data)) throw new Error('Unexpected response shape');
        render(data);
    } catch (error) {
        console.error('There was a problem with your fetch operation:', error);
    }
}

When it happens

Trigger: Calling send_token() from a page whose URL is not /vulnerabilities/cryptography/index.php, so the relative 'source/check_token_high.php' resolves to a non-existent path (404); a PHP fatal (ext-openssl absent, parse error in the required token_library_high.php) returning 500; a reverse proxy replying 502/503 while PHP is down.

Common situations: Accessing the module through an alias, rewrite, or nested path that changes relative-URL resolution; hardened PHP images without ext-openssl; moving or renaming the source/ directory; API gateways in front of the app that block direct POSTs to .php files.

Related errors

• Network response was not ok
• Network response was not ok
• Network response was not ok
• Decryption failed
• Could not decode JSON object.

AI-assisted analysis of digininja/DVWA@5d5c76cced (2026-08-21). Data as JSON: /api/errors/d9e485d57e86a18c. Report an issue: GitHub.