JettyWebSocketServerContainer exposes websocket common classes

[gregw]

The classes in org.eclipse.jetty.websocket.server must not expose org.eclipse.jetty.websocket.common classes in the public signature. However, this is done by at least JettyWebSocketServerContainer#addSessionListener

Only API or other server classes should be exposed.

[sbordet]

Just to be clear, I'm not sure where the problem is exactly. Since Jetty 10 protectAndExpose only o.e.j.websocket.server, would it be possible to invoke addListener(), which requires a o.e.j.websocket.common class as parameter?

Point being that we don't want to protectAndExpose o.e.j.websocket.common classes to web applications, because if they use WebSocketClient they will have their own copy of o.e.j.websocket.common classes which leads to LinkageError.

[joakime]

seems like moving WebSocketSessionListener to org.eclipse.jetty.websocket.api makes the most sense here.

[gregw]

I'm OK for moving the listener.... but before doing anything we probably need to review the entire exposed API and find all such exposed common/core/io/http classes