feat: Introduce Playwright for UI testing

Instead of using Robot Framework which does not run during a `mvn install`. Playwright seems to be the better approach. We can now write them as normal JUnit test and they are executed during a build.

Additionally this PR solves some interesting bugs found during writing Playwright tests:

- A reset of a lesson removes all assignments as a result another user wouldn't see any assignments
- If someone solves an assignment the assignment automatically got solved for a new user since the assignment included the `solved` flag which immediately got copied to new lesson progress.
- Introduction of assignment progress linking a assignment not directly to all users.

src/it/java/org/owasp/webgoat/ServerUrlConfig.java

@@ -0,0 +1,36 @@
+package org.owasp.webgoat;
+
+public record ServerUrlConfig(String host, String port, String contextPath) {
+
+  public ServerUrlConfig {
+    contextPath = contextPath.replaceAll("/", "");
+  }
+
+  public String getBaseUrl() {
+    return "http://%s:%s".formatted(host, port);
+  }
+
+  public String url(String path) {
+    return "%s/%s".formatted(getFullUrl(), path);
+  }
+
+  private String getFullUrl() {
+    return "http://%s:%s/%s".formatted(host, port, contextPath);
+  }
+
+  public static ServerUrlConfig webGoat() {
+    return new ServerUrlConfig(
+        "localhost", env("WEBGOAT_PORT", "8080"), env("WEBGOAT_CONTEXT", "WebGoat"));
+  }
+
+  public static ServerUrlConfig webWolf() {
+    return new ServerUrlConfig(
+        "localhost", env("WEBWOLF_PORT", "9090"), env("WEBWOLF_CONTEXT", "WebWolf"));
+  }
+
+  private static String env(String variableName, String defaultValue) {
+    return System.getenv().getOrDefault(variableName, "").isEmpty()
+        ? defaultValue
+        : System.getenv(variableName);
+  }
+}

src/it/java/org/owasp/webgoat/integration/AccessControlIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import io.restassured.RestAssured;
 import io.restassured.http.ContentType;

src/it/java/org/owasp/webgoat/integration/CSRFIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;

src/it/java/org/owasp/webgoat/integration/ChallengeIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import static org.junit.jupiter.api.Assertions.assertTrue;
 

src/it/java/org/owasp/webgoat/integration/CryptoIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import static org.junit.jupiter.api.Assertions.fail;
 

src/it/java/org/owasp/webgoat/integration/DeserializationIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import java.io.IOException;
 import java.util.HashMap;

src/it/java/org/owasp/webgoat/integration/GeneralLessonIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import io.restassured.RestAssured;
 import io.restassured.http.ContentType;

src/it/java/org/owasp/webgoat/integration/IDORIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import static org.junit.jupiter.api.DynamicTest.dynamicTest;
 

src/it/java/org/owasp/webgoat/integration/IntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import static io.restassured.RestAssured.given;
 
@@ -11,27 +11,20 @@ import org.hamcrest.CoreMatchers;
 import org.hamcrest.MatcherAssert;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
+import org.owasp.webgoat.ServerUrlConfig;
 import org.springframework.http.HttpStatus;
 
 public abstract class IntegrationTest {
 
-  private static String webGoatPort = System.getenv().getOrDefault("WEBGOAT_PORT", "8080");
-  @Getter private static String webWolfPort = System.getenv().getOrDefault("WEBWOLF_PORT", "9090");
-
-  @Getter
-  private static String webWolfHost = System.getenv().getOrDefault("WEBWOLF_HOST", "127.0.0.1");
-
-  private static String webGoatContext =
-      System.getenv().getOrDefault("WEBGOAT_CONTEXT", "/WebGoat/");
-  private static String webWolfContext =
-      System.getenv().getOrDefault("WEBWOLF_CONTEXT", "/WebWolf/");
+  private final ServerUrlConfig webGoatUrlConfig = ServerUrlConfig.webGoat();
+  @Getter private final ServerUrlConfig webWolfUrlConfig = ServerUrlConfig.webWolf();
 
   @Getter private String webGoatCookie;
   @Getter private String webWolfCookie;
   @Getter private final String user = "webgoat";
 
   protected String url(String url) {
-    return "http://localhost:%s%s%s".formatted(webGoatPort, webGoatContext, url);
+    return webGoatUrlConfig.url(url);
   }
 
   protected class WebWolfUrlBuilder {
@@ -40,8 +33,7 @@ public abstract class IntegrationTest {
     private String path = null;
 
     protected String build() {
-      return "http://localhost:%s%s%s"
-          .formatted(webWolfPort, webWolfContext, path != null ? path : "");
+      return webWolfUrlConfig.url(path != null ? path : "");
     }
 
     /**

src/it/java/org/owasp/webgoat/integration/JWTLessonIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;

src/it/java/org/owasp/webgoat/integration/LabelAndHintIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import io.restassured.RestAssured;
 import io.restassured.http.ContentType;

src/it/java/org/owasp/webgoat/integration/PasswordResetLessonIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import static org.junit.jupiter.api.DynamicTest.dynamicTest;
 
@@ -136,7 +136,7 @@ public class PasswordResetLessonIntegrationTest extends IntegrationTest {
   private void clickForgotEmailLink(String user) {
     RestAssured.given()
         .when()
-        .header(HttpHeaders.HOST, String.format("%s:%s", getWebWolfHost(), getWebWolfPort()))
+        .header(HttpHeaders.HOST, String.format("%s:%s", "127.0.0.1", getWebWolfUrlConfig().port()))
         .relaxedHTTPSValidation()
         .cookie("JSESSIONID", getWebGoatCookie())
         .formParams("email", user)

src/it/java/org/owasp/webgoat/integration/PathTraversalIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import static org.junit.jupiter.api.DynamicTest.dynamicTest;
 

src/it/java/org/owasp/webgoat/integration/ProgressRaceConditionIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import io.restassured.RestAssured;
 import io.restassured.response.Response;

src/it/java/org/owasp/webgoat/integration/SSRFIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import java.util.HashMap;
 import java.util.Map;

src/it/java/org/owasp/webgoat/integration/SessionManagementIntegrationTest.java

@@ -21,7 +21,7 @@
  * Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.
  */
 
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import java.util.Map;
 import org.junit.jupiter.api.Test;

src/it/java/org/owasp/webgoat/integration/SqlInjectionAdvancedIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import java.util.HashMap;
 import java.util.Map;

src/it/java/org/owasp/webgoat/integration/SqlInjectionLessonIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import java.util.HashMap;
 import java.util.Map;

src/it/java/org/owasp/webgoat/integration/SqlInjectionMitigationIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import static org.hamcrest.CoreMatchers.containsString;
 

src/it/java/org/owasp/webgoat/integration/WebWolfIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import static org.junit.jupiter.api.Assertions.assertTrue;
 

src/it/java/org/owasp/webgoat/integration/XSSIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import io.restassured.RestAssured;
 import java.util.HashMap;

src/it/java/org/owasp/webgoat/integration/XXEIntegrationTest.java

@@ -1,4 +1,4 @@
-package org.owasp.webgoat;
+package org.owasp.webgoat.integration;
 
 import io.restassured.RestAssured;
 import io.restassured.http.ContentType;

src/it/java/org/owasp/webgoat/playwright/webgoat/HttpBasicsLessonUITest.java

@@ -0,0 +1,65 @@
+package org.owasp.webgoat.playwright.webgoat;
+
+import static com.microsoft.playwright.assertions.PlaywrightAssertions.assertThat;
+
+import com.microsoft.playwright.*;
+import org.assertj.core.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.MethodOrderer;
+import org.junit.jupiter.api.Order;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestMethodOrder;
+import org.owasp.webgoat.container.lessons.LessonName;
+import org.owasp.webgoat.playwright.webgoat.helpers.Authentication;
+import org.owasp.webgoat.playwright.webgoat.pages.HttpBasicsLessonPage;
+
+@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
+public class HttpBasicsLessonUITest extends PlaywrightTest {
+
+  private HttpBasicsLessonPage lessonPage;
+
+  @BeforeEach
+  void navigateToLesson(Browser browser) {
+    var lessonName = new LessonName("HttpBasics");
+    var page = Authentication.sylvester(browser);
+
+    this.lessonPage = new HttpBasicsLessonPage(page);
+    lessonPage.resetLesson(lessonName);
+    lessonPage.open(lessonName);
+  }
+
+  @Test
+  @Order(1)
+  void shouldShowDefaultPage() {
+    assertThat(lessonPage.getTitle()).hasText("HTTP Basics");
+    Assertions.assertThat(lessonPage.noAssignmentsCompleted()).isTrue();
+    Assertions.assertThat(lessonPage.numberOfAssignments()).isEqualTo(2);
+  }
+
+  @Test
+  @Order(2)
+  @DisplayName(
+      "When the user enters their name, the server should reverse it then the assignment should be"
+          + " solved")
+  void solvePage2() {
+    lessonPage.navigateTo(2);
+    lessonPage.getEnterYourName().fill("John Doe");
+    lessonPage.getGoButton().click();
+
+    assertThat(lessonPage.getAssignmentOutput())
+        .containsText("The server has reversed your name: eoD nhoJ");
+    Assertions.assertThat(lessonPage.isAssignmentSolved(2)).isTrue();
+  }
+
+  @Test
+  @Order(3)
+  @DisplayName("When the user enters nothing then the server should display an error message")
+  void invalidPage2() {
+    lessonPage.navigateTo(2);
+    lessonPage.getEnterYourName().fill("");
+    lessonPage.getGoButton().click();
+
+    assertThat(lessonPage.getAssignmentOutput()).containsText("Try again, name cannot be empty.");
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webgoat/LoginUITest.java

@@ -0,0 +1,27 @@
+package org.owasp.webgoat.playwright.webgoat;
+
+import static com.microsoft.playwright.assertions.PlaywrightAssertions.assertThat;
+
+import com.microsoft.playwright.Browser;
+import com.microsoft.playwright.Page;
+import com.microsoft.playwright.options.AriaRole;
+import org.junit.jupiter.api.Test;
+import org.owasp.webgoat.playwright.webgoat.helpers.Authentication;
+import org.owasp.webgoat.playwright.webgoat.pages.WebGoatLoginPage;
+
+class LoginUITest extends PlaywrightTest {
+
+  @Test
+  void loginLogout(Browser browser) {
+    var page = Authentication.tweety(browser);
+    var loginPage = new WebGoatLoginPage(page);
+    loginPage.open();
+    loginPage.login(Authentication.getTweety().name(), Authentication.getTweety().password());
+
+    // logout
+    page.getByRole(AriaRole.BUTTON, new Page.GetByRoleOptions().setName("")).click();
+    page.getByRole(AriaRole.MENUITEM, new Page.GetByRoleOptions().setName("Logout")).click();
+
+    assertThat(loginPage.getSignInButton()).isVisible();
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webgoat/PlaywrightTest.java

@@ -0,0 +1,33 @@
+package org.owasp.webgoat.playwright.webgoat;
+
+import com.microsoft.playwright.Browser;
+import com.microsoft.playwright.junit.Options;
+import com.microsoft.playwright.junit.OptionsFactory;
+import com.microsoft.playwright.junit.UsePlaywright;
+import org.owasp.webgoat.ServerUrlConfig;
+
+@UsePlaywright(PlaywrightTest.WebGoatOptions.class)
+public class PlaywrightTest {
+
+  private static final ServerUrlConfig webGoatUrlConfig = ServerUrlConfig.webGoat();
+  private static final ServerUrlConfig webWolfUrlConfig = ServerUrlConfig.webWolf();
+
+  public static class WebGoatOptions implements OptionsFactory {
+    @Override
+    public Options getOptions() {
+      return new Options().setHeadless(true).setContextOptions(getContextOptions());
+    }
+  }
+
+  protected static Browser.NewContextOptions getContextOptions() {
+    return new Browser.NewContextOptions().setBaseURL(webGoatUrlConfig.getBaseUrl());
+  }
+
+  public static String webGoatUrl(String path) {
+    return webGoatUrlConfig.url(path);
+  }
+
+  public static String webWolfURL(String path) {
+    return webWolfUrlConfig.url(path);
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webgoat/helpers/Authentication.java

@@ -0,0 +1,61 @@
+package org.owasp.webgoat.playwright.webgoat.helpers;
+
+import static com.microsoft.playwright.assertions.PlaywrightAssertions.assertThat;
+
+import com.microsoft.playwright.Browser;
+import com.microsoft.playwright.Page;
+import lombok.Getter;
+import org.owasp.webgoat.playwright.webgoat.pages.RegistrationPage;
+import org.owasp.webgoat.playwright.webgoat.pages.WebGoatLoginPage;
+import org.owasp.webgoat.playwright.webwolf.pages.WebWolfLoginPage;
+
+/**
+ * Helper class to authenticate users in WebGoat and WebWolf.
+ *
+ * <p>It provides two users: sylvester and tweety. The users are authenticated by logging in to
+ * WebGoat and WebWolf. Once authenticated, the user's authentication token is stored in the browser
+ * and reused for subsequent requests.
+ */
+public class Authentication {
+
+  public record User(String name, String password, String auth) {
+    boolean loggedIn() {
+      return auth != null;
+    }
+  }
+
+  @Getter private static User sylvester = new User("sylvester", "sylvester", null);
+  @Getter private static User tweety = new User("tweety", "tweety", null);
+
+  public static Page sylvester(Browser browser) {
+    User user = login(browser, sylvester);
+    return browser.newContext(new Browser.NewContextOptions().setStorageState(user.auth)).newPage();
+  }
+
+  public static Page tweety(Browser browser) {
+    User user = login(browser, tweety);
+    return browser.newContext(new Browser.NewContextOptions().setStorageState(user.auth)).newPage();
+  }
+
+  private static User login(Browser browser, User user) {
+    if (user.loggedIn()) {
+      return user;
+    }
+    var page = browser.newContext().newPage();
+    RegistrationPage registrationPage = new RegistrationPage(page);
+    registrationPage.open();
+    registrationPage.register(user.name, user.password);
+
+    WebGoatLoginPage loginPage = new WebGoatLoginPage(page);
+    loginPage.open();
+    loginPage.login(user.name, user.password);
+    assertThat(loginPage.getSignInButton()).not().isVisible();
+
+    WebWolfLoginPage webWolfLoginPage = new WebWolfLoginPage(page);
+    webWolfLoginPage.open();
+    webWolfLoginPage.login(user.name, user.password);
+    assertThat(loginPage.getSignInButton()).not().isVisible();
+
+    return new User(user.name, user.password, page.context().storageState());
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webgoat/pages/HttpBasicsLessonPage.java

@@ -0,0 +1,24 @@
+package org.owasp.webgoat.playwright.webgoat.pages;
+
+import com.microsoft.playwright.Locator;
+import com.microsoft.playwright.Page;
+import com.microsoft.playwright.options.AriaRole;
+import lombok.Getter;
+
+@Getter
+public class HttpBasicsLessonPage extends LessonPage {
+
+  private final Locator enterYourName;
+  private final Locator goButton;
+
+  public HttpBasicsLessonPage(Page page) {
+    super(page);
+    enterYourName = page.locator("input[name=\"person\"]");
+    goButton = page.getByRole(AriaRole.BUTTON, new Page.GetByRoleOptions().setName("Go!"));
+  }
+
+  public Locator getTitle() {
+    return getPage()
+        .getByRole(AriaRole.HEADING, new Page.GetByRoleOptions().setName("HTTP Basics"));
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webgoat/pages/LessonPage.java

@@ -0,0 +1,64 @@
+package org.owasp.webgoat.playwright.webgoat.pages;
+
+import static org.owasp.webgoat.playwright.webgoat.PlaywrightTest.webGoatUrl;
+
+import com.microsoft.playwright.Locator;
+import com.microsoft.playwright.Page;
+import com.microsoft.playwright.options.AriaRole;
+import lombok.Getter;
+import org.assertj.core.api.Assertions;
+import org.owasp.webgoat.container.lessons.LessonName;
+
+@Getter
+class LessonPage {
+
+  private final Page page;
+
+  public LessonPage(Page page) {
+    this.page = page;
+  }
+
+  public void navigateTo(int pageNumber) {
+    page.getByRole(AriaRole.LINK, new Page.GetByRoleOptions().setName("" + pageNumber)).click();
+  }
+
+  public void open(LessonName lessonName) {
+    page.navigate(webGoatUrl("start.mvc#lesson/%s".formatted(lessonName.lessonName())));
+  }
+
+  /**
+   * Force a reload for the UI to response, this is normally done by a JavaScript reloading every 5
+   * seconds
+   */
+  public void refreshPage() {
+    page.reload();
+  }
+
+  public void resetLesson(LessonName lessonName) {
+    Assertions.assertThat(
+            page.request()
+                .get(webGoatUrl("service/restartlesson.mvc/%s".formatted(lessonName)))
+                .ok())
+        .isTrue();
+    refreshPage();
+  }
+
+  public int numberOfAssignments() {
+    return page.locator(".attack-link.solved-false").count()
+        + page.locator(".attack-link.solved-true").count();
+  }
+
+  public boolean isAssignmentSolved(int pageNumber) {
+    var solvedAssignments = page.locator(".attack-link.solved-true");
+    solvedAssignments.waitFor();
+    return solvedAssignments.all().stream().anyMatch(l -> l.textContent().equals("" + pageNumber));
+  }
+
+  public boolean noAssignmentsCompleted() {
+    return page.locator(".attack-link.solved-true").count() == 0;
+  }
+
+  public Locator getAssignmentOutput() {
+    return page.locator("#lesson-content-wrapper");
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webgoat/pages/RegistrationPage.java

@@ -0,0 +1,32 @@
+package org.owasp.webgoat.playwright.webgoat.pages;
+
+import static com.microsoft.playwright.options.AriaRole.BUTTON;
+import static org.owasp.webgoat.playwright.webgoat.PlaywrightTest.webGoatUrl;
+
+import com.microsoft.playwright.Locator;
+import com.microsoft.playwright.Page;
+import com.microsoft.playwright.options.AriaRole;
+import lombok.Getter;
+
+public class RegistrationPage {
+
+  private final Page page;
+  @Getter private final Locator signUpButton;
+
+  public RegistrationPage(Page page) {
+    this.page = page;
+    this.signUpButton = this.page.getByRole(BUTTON, new Page.GetByRoleOptions().setName("Sign up"));
+  }
+
+  public void open() {
+    page.navigate(webGoatUrl("registration"));
+  }
+
+  public void register(String username, String password) {
+    page.getByPlaceholder("Username").fill(username);
+    page.getByLabel("Password", new Page.GetByLabelOptions().setExact(true)).fill(password);
+    page.getByLabel("Confirm password").fill(password);
+    page.getByLabel("Agree with the terms and").check();
+    page.getByRole(AriaRole.BUTTON, new Page.GetByRoleOptions().setName("Sign up")).click();
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webgoat/pages/WebGoatLoginPage.java

@@ -0,0 +1,29 @@
+package org.owasp.webgoat.playwright.webgoat.pages;
+
+import static com.microsoft.playwright.options.AriaRole.BUTTON;
+import static org.owasp.webgoat.playwright.webgoat.PlaywrightTest.webGoatUrl;
+
+import com.microsoft.playwright.Locator;
+import com.microsoft.playwright.Page;
+import lombok.Getter;
+
+public class WebGoatLoginPage {
+
+  private final Page page;
+  @Getter private final Locator signInButton;
+
+  public WebGoatLoginPage(Page page) {
+    this.page = page;
+    this.signInButton = this.page.getByRole(BUTTON, new Page.GetByRoleOptions().setName("Sign in"));
+  }
+
+  public void open() {
+    page.navigate(webGoatUrl("login"));
+  }
+
+  public void login(String username, String password) {
+    page.getByPlaceholder("Username").fill(username);
+    page.getByPlaceholder("Password").fill(password);
+    page.getByRole(BUTTON, new Page.GetByRoleOptions().setName("Sign in")).click();
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webwolf/JwtUITest.java

@@ -0,0 +1,32 @@
+package org.owasp.webgoat.playwright.webwolf;
+
+import static com.microsoft.playwright.assertions.PlaywrightAssertions.assertThat;
+
+import com.microsoft.playwright.Browser;
+import org.junit.jupiter.api.Test;
+import org.owasp.webgoat.playwright.webgoat.PlaywrightTest;
+import org.owasp.webgoat.playwright.webgoat.helpers.Authentication;
+
+class JwtUITest extends PlaywrightTest {
+
+  @Test
+  void shouldDecodeJwt(Browser browser) {
+    var page = Authentication.sylvester(browser);
+    var secretKey = "test";
+    var jwt =
+        "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
+
+    page.navigate(webWolfURL("jwt"));
+    page.getByPlaceholder("Enter your secret key").fill(secretKey);
+    page.getByPlaceholder("Paste token here").type(jwt);
+    assertThat(page.locator("#header"))
+        .hasValue("{\n  \"alg\" : \"HS256\",\n  \"typ\" : \"JWT\"\n}");
+    assertThat(page.locator("#payload"))
+        .hasValue(
+            "{\n"
+                + "  \"iat\" : 1516239022,\n"
+                + "  \"name\" : \"John Doe\",\n"
+                + "  \"sub\" : \"1234567890\"\n"
+                + "}");
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webwolf/LoginUITest.java

@@ -0,0 +1,27 @@
+package org.owasp.webgoat.playwright.webwolf;
+
+import static com.microsoft.playwright.assertions.PlaywrightAssertions.assertThat;
+
+import com.microsoft.playwright.Browser;
+import org.junit.jupiter.api.Test;
+import org.owasp.webgoat.playwright.webgoat.PlaywrightTest;
+import org.owasp.webgoat.playwright.webgoat.helpers.Authentication;
+import org.owasp.webgoat.playwright.webwolf.pages.WebWolfLoginPage;
+
+public class LoginUITest extends PlaywrightTest {
+
+  @Test
+  void login(Browser browser) {
+    var page = Authentication.tweety(browser);
+    var loginPage = new WebWolfLoginPage(page);
+    loginPage.open();
+    loginPage.login(Authentication.getTweety().name(), Authentication.getTweety().password());
+
+    assertThat(loginPage.getSignInButton()).not().isVisible();
+
+    // logout
+    loginPage.logout();
+
+    assertThat(loginPage.getSignInButton()).isVisible();
+  }
+}

src/it/java/org/owasp/webgoat/playwright/webwolf/pages/WebWolfLoginPage.java

@@ -0,0 +1,37 @@
+package org.owasp.webgoat.playwright.webwolf.pages;
+
+import static com.microsoft.playwright.options.AriaRole.BUTTON;
+import static org.owasp.webgoat.playwright.webgoat.PlaywrightTest.webWolfURL;
+
+import com.microsoft.playwright.Locator;
+import com.microsoft.playwright.Page;
+import com.microsoft.playwright.options.AriaRole;
+import lombok.Getter;
+
+public class WebWolfLoginPage {
+
+  private final Page page;
+  @Getter private final Locator signInButton;
+  private final Locator signOutButton;
+
+  public WebWolfLoginPage(Page page) {
+    this.page = page;
+    this.signInButton = this.page.getByRole(BUTTON, new Page.GetByRoleOptions().setName("Sign In"));
+    this.signOutButton =
+        this.page.getByRole(AriaRole.LINK, new Page.GetByRoleOptions().setName("Sign out"));
+  }
+
+  public void open() {
+    page.navigate(webWolfURL("login"));
+  }
+
+  public void login(String username, String password) {
+    page.getByPlaceholder("Username WebGoat").fill(username);
+    page.getByPlaceholder("Password WebGoat").fill(password);
+    signInButton.click();
+  }
+
+  public void logout() {
+    this.signOutButton.click();
+  }
+}