Atmosphere endpoint is intercepting all Web Socket requests

[MarcinVaadin]

Description of the bug

After #13960 Atmosphere endpoint is mapped to / which causes that all Web Socket requests are handled by Atmosphere handlers. It became impossible to register own Web Socket handlers.

Description and reproducible example is present on https://stackoverflow.com/questions/73791155/upgrading-to-vaadinwebsecurity-is-breaking-custom-websocket/73798818#73798818

Workaround - exclusion of Atmosphere:

<dependency>
    <groupId>com.vaadin</groupId>
    <!-- Replace artifactId with vaadin-core to use only free components -->
    <artifactId>vaadin</artifactId>
    <exclusions>
        <exclusion>
            <groupId>com.vaadin.external.atmosphere</groupId>
            <artifactId>atmosphere-runtime</artifactId>
        </exclusion>
    </exclusions>
</dependency>

Expected behavior

It should be possible to register custom Web Socket handlers.

Minimal reproducible example

Available on https://stackoverflow.com/questions/73791155/upgrading-to-vaadinwebsecurity-is-breaking-custom-websocket/73798818#73798818

Versions

• Vaadin / Flow version: 23.2
• Java version: 17

[ggecy]

+1
This has very high priority for our project since we cannot deploy vaadin 23.2.0 to our production systems because of it. We have vaadin push enabled and using it extensively (so the workaround is not applicable) while at the same time we are using spring websockets which now don't work.

[Artur-]

I think the summary is slightly wrong as the websocket endpoint was SUPPOSED to be mapped to / only but as the path mapping length of Atmosphere is set to 5 by default it is also mapped to urls like /{path} and /{path}/{path}. Making it mapped to only the servlet path should fix this, drafted in #14638

[Tonne-TM]

@Artur- The issue still exists. If you update the example provided at StackOverflow to Vaadin 23.2.3 the custom WebSocket is still overwritten by the Atmosphere framework returning

for(;;);[{"meta":{"async":true,"sessionExpired":true}}]

Update: Mistake on my side, forgot to delete some generated files, when updating version.

[Artur-]

If I take the app, change to 23.2.3 and run new WebSocket("ws://localhost:8080/websocket") in the browser I see

connected

in the server log