fix(it): static mutable user objects shared across test instances causing race condition
Author: kumburovicbranko682-boopCreated Jun 27, 2026Updated Aug 2, 2026
Description
The sylvester and tweety fields are static mutable User instances initialized with auth = null.
The login() method checks user.loggedIn() (which returns true if auth != null) but returns a NEW
User instance with the auth state, without updating the original static field. This means:
- In parallel test execution, multiple threads could call
sylvester(browser)simultaneously - Each call sees
auth == nulland creates a new registration + login flow - The first call returns and updates
authin its local copy, but the static field remains null - All subsequent calls still see
auth == nulland repeat registration
This causes test flakiness due to race conditions on WebGoat's user database and wastes resources by creating multiple browser contexts/pages when only one was intended.
Severity: medium
File: src/it/java/org/owasp/webgoat/playwright/webgoat/helpers/Authentication.java
Expected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.
Source: WebGoat/WebGoat