refactor(it): static mutable user objects shared across test instances causing race condition - #2474

✨ Code Quality

Problem

The sylvester and tweety fields are static mutable User instances initialized with auth = null.
The login() method checks user.loggedIn() (which returns true if auth != null) but returns a NEW
User instance with the auth state, without updating the original static field. This means:

1. In parallel test execution, multiple threads could call sylvester(browser) simultaneously
2. Each call sees auth == null and creates a new registration + login flow
3. The first call returns and updates auth in its local copy, but the static field remains null
4. All subsequent calls still see auth == null and repeat registration

This causes test flakiness due to race conditions on WebGoat's user database and wastes resources
by creating multiple browser contexts/pages when only one was intended.

Severity: medium
File: src/it/java/org/owasp/webgoat/playwright/webgoat/helpers/Authentication.java

Solution

Either make the static fields volatile and update them in the login methods, or change the design
to avoid shared mutable state. The simplest fix is to update the static fields:

Changes

• src/it/java/org/owasp/webgoat/playwright/webgoat/helpers/Authentication.java (modified)

Thank you for submitting a pull request to the WebGoat!

Closes #2473