digininja/DVWA · error · Error

Network response was not ok

Error message

Network response was not ok

What it means

Thrown by the page's own fetch handler in get_users() when GET /vulnerabilities/api/v2/user/ replies with a non-2xx HTTP status; response.ok is only true for 200-299, and the handler converts every other status into this generic Error before response.json() runs. In DVWA that URL is rewritten by vulnerabilities/api/.htaccess to public/index.php, which returns 404 for unrecognized paths, 404 for unknown user ids, and 500 when the composer vendor directory is missing (bootstrap.php fatals on require 'vendor/autoload.php').

Source

Thrown at vulnerabilities/api/source/low.php:54

		}

		const message_line = document.getElementById ('message');
		if (user_json.id == 2 && user_json.level == 0) {
			message_line.style.display = 'block';
		} else {
			message_line.style.display = 'none';
		}
	}

	function get_users() {
		const url = '" . $stripped_url . "/vulnerabilities/api/v2/user/';
		 
		fetch(url, { 
				method: 'GET',
			}) 
			.then(response => { 
				if (!response.ok) { 
					throw new Error('Network response was not ok'); 
			} 
			return response.json(); 
			}) 
			.then(data => { 
				loadTableData(data);
			}) 
			.catch(error => { 
				console.error('There was a problem with your fetch operation:', error); 
		}); 
	}

	HTMLTableRowElement.prototype.insert_th_Cell = function(index) {
		let cell = this.insertCell(index)
		, c_th = document.createElement('th');
		cell.replaceWith(c_th);
		return c_th;
	}

View on GitHub (pinned to 5d5c76cced)

Solutions

1. Open DevTools > Network and re-run the request to see the real status code (404 vs 500 points to routing vs fatal).
2. Run composer install inside vulnerabilities/api/ to fix the 500 caused by the missing vendor/autoload.php require.
3. Enable mod_rewrite (a2enmod rewrite) and set AllowOverride All for the DVWA vhost so .htaccess routes /v2/* to public/index.php.
4. View the generated page source and verify the fetch URL is a clean path ending in /vulnerabilities/api/v2/user/ with no query-string fragment from $stripped_url.
5. Sanity-check the router with GET /vulnerabilities/api/v2/user/1 (seeded user) directly in the browser.

Example fix

// before
.then(response => {
    if (!response.ok) {
        throw new Error('Network response was not ok');
    }
    return response.json();
})
// after
.then(response => {
    if (!response.ok) {
        throw new Error(`Request failed: ${response.status} ${response.statusText}`);
    }
    return response.json();
})

function validApiUrl(url) {
    return /^https?:\/\/[^\/]+\/vulnerabilities\/api\/v\d+\/user\/?$/.test(url);
}
// before calling get_users()
if (!validApiUrl(url)) {
    console.error('Refusing to fetch malformed API URL:', url);
    return;
}

function isUserList(payload) {
    return Array.isArray(payload) && payload.every(u =>
        typeof u === 'object' && u !== null && 'name' in u && 'level' in u);
}

async function getUsersSafe(url) {
    try {
        const response = await fetch(url, { method: 'GET' });
        if (!response.ok) {
            throw new Error(`Request failed: ${response.status} ${response.statusText}`);
        }
        const data = await response.json();
        if (!isUserList(data)) throw new Error('Unexpected payload shape');
        loadTableData(data);
    } catch (error) {
        console.error('There was a problem with your fetch operation:', error);
    }
}

When it happens

Trigger: Calling get_users() (it runs automatically on page load) when mod_rewrite is disabled or AllowOverride prevents the .htaccess rewrite, so /v2/user/ hits a real 404; when 'composer install' was never run inside vulnerabilities/api/ so the front controller dies with HTTP 500; when the query string of $_SERVER['REQUEST_URI'] leaks into $stripped_url and the concatenated fetch URL is malformed; or when the router sees a path that does not match /v[0-9]/(user|order|login|health).

Common situations: Fresh DVWA clone where composer dependencies were skipped; Apache without mod_rewrite or with AllowOverride None; accessing the page through a URL carrying extra query parameters; renaming the api directory or moving DVWA under a subpath while assuming hard-coded routing.

Related errors

• Network response was not ok
• Network response was not ok
• Network response was not ok
• Decryption failed
• No token passed

AI-assisted analysis of digininja/DVWA@5d5c76cced (2026-08-21). Data as JSON: /api/errors/9d7e28fb2389b148. Report an issue: GitHub.