Help with Stuck Tests - Secure Multiplayer Game

[emanuelgm1998]

Tell us what’s happening:

Mi proyecto “Secure Real Time Multiplayer Game” falla los tests de seguridad de Helmet (16-19). He verificado con las herramientas del navegador que mi servidor envía correctamente todas las cabeceras requeridas.

El test falla incluso cuando envío una URL completamente diferente como https://www.youtube.com, dando el mismo error exacto.

Esto prueba que el evaluador tiene un bug y no está procesando la URL, probablemente está atascado en un resultado fallido. ¿Podrían investigar o revisar mi pr

###Your project link(s)

solution: https://secure-multiplayer-emanuelgm1998-production.up.railway.app

githubLink: https://github.com/Emanuelgm1998/secure-multiplayer-emanuelgm1998

Your browser information:

User Agent is: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Challenge Information:

Information Security Projects - Secure Real Time Multiplayer Game

freeCodeCamp.org

Solution Link

Secure Multiplayer Game

Source Code Link

https://github.com/Emanuelgm1998/secure-multiplayer-emanuelgm1998

[emanuelgm1998]

Solution Link

Secure Multiplayer Game

Source Code Link

GitHub - Emanuelgm1998/secure-multiplayer-emanuelgm1998

[ILM]

open the browser console when you run the tests, you will see more details on the failures

[emanuelgm1998]

Thanks for your reply.

I’ve double-checked everything as suggested — the browser console shows CORS errors on tests 16–19, even though all security headers are correctly set.

Headers are implemented:

• X-Powered-By: PHP 7.4.3
• Content-Security-Policy
• Cache-Control: no-store
• X-XSS-Protection, X-Content-Type-Options
• CORS enabled
• /api/app-info responds correctly

Live project: https://secure-multiplayer-emanuelgm1998-production.up.railway.app/
GitHub repo: GitHub - Emanuelgm1998/secure-multiplayer-emanuelgm1998

I believe the issue is on the test evaluator side.
Could you please manually validate the project so I can receive my Information Security Certification?

Thanks so much in advance — I really appreciate your time

[ILM]

@emanuelgm1998

Could you please manually validate the project

That is not possible

look at how other people have solved the cors issue in the forum

for example

Information Security with HelmetJS - Understand BCrypt Hashes

Hello i am in need of your help passing: Understand BCrypt Hashes. I am using VScode to do this project and i have copied the boiler plate and ran ‘npm install, npm install bcrypt’ ect. bcrypt is a dependency and i have in the server.js file: const bcrypt = requiere(‘bcrypt’); at the top of the code. but when i submit the localhost url, both test fail. should i use glitch as i see on YouTube or is it a version problem? the boilerplate version is v5.0.1 ###Your project link(s) solution: h…

[emanuelgm1998]

Hello, thank you for your reply.

I respectfully want to clarify that the example you shared (about bcrypt) is unrelated to my project. My issue is not about bcrypt, hashing, or local development, but with the Secure Real Time Multiplayer Game project, which uses WebSockets, Helmet, CSP headers, and other security configurations.

I have implemented all the required headers correctly:

• X-Powered-By: PHP 7.4.3
• Content-Security-Policy
• Cache-Control: no-store
• /api/app-info endpoint responds correctly
• Helmet v3 configuration applied correctly

I’ve tested this project on multiple platforms: Render, Codespaces, Railway, and Replit. In all cases, tests 16–19 fail due to CORS or validator limitations, not due to missing functionality or headers.

Other users have received manual validation in similar situations when tests fail due to environment issues. I kindly request the same review, since all the technical requirements are fulfilled and the project is fully functional.

Here is the project link again for review:
https://secure-multiplayer-emanuelgm1998-production.up.railway.app/

I would really appreciate your help in reviewing this case fairly.
Thank you very much,
Emanuel

[JeremyLT]

It does not look like you have attempted the CORS fix in the linked thread. I would try that.

[ILM]

@emanuelgm1998

Other users have received manual validation in similar situations when tests fail due to environment issues.

that is not something I have ever seen happening

while the project is a different one, the CORS issue experienced is the same

alternatively you can wait for the CORS issue to be solved on freeCodeCamp side