Switch web API/permission code to use IsOriginSecure() instead of SchemeIsSecure().

components/autofill/content/browser/wallet/wallet_service_url_unittest.cc

Index: components/autofill/content/browser/wallet/wallet_service_url_unittest.cc
diff --git a/components/autofill/content/browser/wallet/wallet_service_url_unittest.cc b/components/autofill/content/browser/wallet/wallet_service_url_unittest.cc
index de289e668e692ae0812be235c0f9ba3e070b5a5a..0a9f3b8ddd2356ac51407075b854c426f6019219 100644
--- a/components/autofill/content/browser/wallet/wallet_service_url_unittest.cc
+++ b/components/autofill/content/browser/wallet/wallet_service_url_unittest.cc
@@ -6,6 +6,7 @@
 #include "components/autofill/content/browser/wallet/wallet_service_url.h"
 #include "components/autofill/core/common/autofill_switches.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/origin_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
@@ -115,7 +116,7 @@ TEST(WalletServiceUrl, IsUsingProd) {
 }
 
 TEST(WalletServiceUrl, IsSignInContinueUrl) {
-  EXPECT_TRUE(GetSignInContinueUrl().SchemeIsSecure());

[Dan Beam, 2015/05/07 20:50:53]

the intent of this is to ensure the transmission of data is encrypted.
IsOriginSecure() does not require this, as far as I can tell.

[lgarron, 2015/05/07 20:55:33]

Is the intent to ensure that it is literally encrypted (using HTTPS/WSS), or
that it is trusted as much as an encrypted connection?

IsOriginSecure() is meant to capture the latter, but SchemeIsCryptographic() is
appropriate for the former.

[palmer, 2015/05/07 20:57:10]

Correct: |IsOriginSecure| will also return true for origins that are not
cryptographically protected, and for which that does not matter:
http://localhost, extension URLs, and so on.

It might be that we should say

    EXPECT_TRUE(GetSignInContinueUrl().SchemeIsCryptographic());

here instead. (|SchemeIsCryptographic| is the more precisely-defined replacement
for |SchemeIsSecure|.)

[Dan Beam, 2015/05/07 20:58:29]

it'd probably allow http:// trusted origins as well, no?
yep

[lgarron, 2015/05/07 21:08:32]

It allows HTTP origins if the host is localhost, or if the user has passed an
explicit commandline flag to trust it.

Given your concern, it seems that SchemeIsSecure() is safe. Since it's in a
test, no one should need this to work for localhost or with a special override.
I've made the change in the latest patch.

+  EXPECT_TRUE(IsOriginSecure(GetSignInContinueUrl()));
 
   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
   command_line->AppendSwitchASCII(switches::kWalletServiceUseSandbox, "1");