#2473·WebGoat

fix(it): static mutable user objects shared across test instances causing race condition

Author: kumburovicbranko682-boopCreated Jun 27, 2026Updated Aug 2, 2026

Description

The sylvester and tweety fields are static mutable User instances initialized with auth = null. The login() method checks user.loggedIn() (which returns true if auth != null) but returns a NEW User instance with the auth state, without updating the original static field. This means:

  1. In parallel test execution, multiple threads could call sylvester(browser) simultaneously
  2. Each call sees auth == null and creates a new registration + login flow
  3. The first call returns and updates auth in its local copy, but the static field remains null
  4. All subsequent calls still see auth == null and repeat registration

This causes test flakiness due to race conditions on WebGoat's user database and wastes resources by creating multiple browser contexts/pages when only one was intended.

Severity: medium File: src/it/java/org/owasp/webgoat/playwright/webgoat/helpers/Authentication.java

Expected Behavior

The code should handle this case properly to avoid unexpected errors or degraded quality.