Why is my variable changing when its getter is called?

My project involves SpringBoot. So in a Service I've created a method to retrieve the default indices available to all users :

@Service
public class UserService {

@Autowired
private UserRepository userRepository;

@Autowired
private IndexRepository indexRepository;



/**
 * Read from application.properties
 *
 * We only store the index ids in the application.properties
 */
@Value("${default.allowed.ids}")
private String defaultAllowedIds;

// I've also tried and removed the static with the same behaviour
private static HashSet<Index> listOfDefaultAllowedIndex = null;

public User findByUsername(String username) {
    return userRepository.findByUsername(username);
}

public User findByResetToken(String resetToken) {
    return userRepository.findByResetToken(resetToken);
}

/**
 * Saves the user in the database and encrypts the password with bcrypt.
 *
 * @param user
 */
public void save(User user) {

	// Code to save a new user

}

public void update(User user) {

	// COde to update the user
}

/**
 * List the default index allowed by default to all users
 *
 * @return the listOfDefaultAllowedIndex
 */
private HashSet<IndexSetup> getListOfDefaultAllowedIndex() {
    
    System.err.println("TEST : DEFAULT LIST CONTAINS " + (listOfDefaultAllowedIndex != null ? 
            listOfDefaultAllowedIndex.size() + " index" : "NULL"));
            // This is null at the beginning then it grows
    
    System.err.println("TEST : THE DEFAULT STRING IS " + defaultAllowedIndexIds); 
    // This is always an empty string

    if (listOfDefaultAllowedIndex == null) {


        // 1) Gets the ids from the property
        HashSet<String> defaultIds = new HashSet(Stream.of(
                defaultAllowedIndexIds.split(
                        SEMI_COLON_SEPARATOR)).collect(Collectors.toSet()));
        
        System.err.println("TEST : DEFAULT IDS : " + defaultIds); // THis is empty
                    

        // 2) Converts them into list of Index object
        listOfDefaultAllowedIndex = new HashSet(StreamSupport
                .stream(indexRepository.findAll().spliterator(),
                        false)
                .filter(idx -> defaultIds.contains(Integer.toString(
                idx.getId())))
                .collect(Collectors.toSet()));
        
        System.err.println("TEST : CONVERTED INDEX : ");
        listOfDefaultAllowedIndex.stream().forEach(
                    idx -> System.err.println(idx.getName() + " (" + idx.getId() + ")")); // THis is empty

    }
    
     System.err.println("TEST : READING FROM CACHE (FROM THREAD " + Thread.currentThread().getName() + ") FOR THE DEFAULT IDS : ");
        listOfDefaultAllowedIndex.stream().forEach(
                    idx -> System.err.println(idx.getName() + " (" + idx.getId() + ")"));
                    // THis should be empty but is growing

    return listOfDefaultAllowedIndex;
}

So everytime getListOfDefaultAllowedIndex is called the listOfDefaultAllowedIndex grows (actually it would grow if it was a List but it is a Set) although the property in application.properties does not change and listOfDefaultAllowedIndexis only changed in that method (when it is null so when the server is reset). I've searched with Find Usage or Find in project functions from the IDE and could not find any results except in that method.

I noticed that the thread name was different but I can't figure out how a race condition would change the value to something different than empty.

PLease note : I've noticed that if I remove the class variable listOfDefaultAllowedIndex as well as the if listOfDefaultAllowedIndex == null condition, and declare listOfDefaultAllowedIndex in the method, then it works as expected, the listOfDefaultAllowedIndex remains empty (in that case where the property is empty), but I can't explain why.

Consequently what could make the variable change ?

EDIT

As pointed out by @RalfKleberhoff I was indeed leaking the original HashSet by doing this in another method :

HashSet<Index> allowedIndexes = this.getListOfDefaultAllowedIndex();
//...
allowedIndexes.addAll(...);

This other old question actually answers mine.

And to combat this I must return an immutable version of the Set by wrapping the Set into Collections.unmodifiableSet(listOfDefaultAllowedIndex) as proposed in the answer below. Wow I completely forgot that!

Any help appreciated

Most probable reason:

You're leaking your internal HashSet to callers of your getter.

So, if a caller modifies the HashSet it got as return value from your getter, this change will get reflected in your internal field value, as it's the very same HashSet object.

To check: return a Collections.unmodifiableSet(listOfDefaultAllowedIndex) from your getter (and adjust the return type to be a Set instead of HashSet). Then any caller trying to change the Set will get an exception instead of modifying anything. Then you can decide how to go on: e.g. have this caller make a copy, always return a copy of the field's HashSet