Create FormatUrlForSecurityDisplay helper function.

chrome/browser/ui/elide_url.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This file defines utility functions for eliding URLs.
 
 #ifndef CHROME_BROWSER_UI_ELIDE_URL_H_
 #define CHROME_BROWSER_UI_ELIDE_URL_H_
 
 #include <string>
@@ skipping 27 matching lines @@
 
 // This function takes a GURL object and elides the host to fit within
 // the given width. The function will never elide past the TLD+1 point,
 // but after that, will leading-elide the domain name to fit the width.
 // Example: http://sub.domain.com ---> "...domain.com", or "...b.domain.com"
 // depending on the width.
 base::string16 ElideHost(const GURL& host_url,
                          const gfx::FontList& font_list,
                          float available_pixel_width);
 
+// This is a convenience function for formatting a URL as an origin in a concise
+// and human-friendly way. Use this instead of |net::FormatUrl| when the reader
+// needs only to understand the origin (rather than the entire URL).
+//
+// - Omits the path for standard schemes, excepting file and filesystem.
+// - Omits the port if it is the default for the scheme.
+//
+// Do not use this for URLs which will be parsed or sent to other applications.
+// Callers should only set |omit_scheme| to true when it is safe to do so: in
+// contexts where the origin is known to be secure or is always secure by
+// necessity. (For example when GURL::SchemeIsCryptographic() or
+// content::IsOriginSecure() return true.

[Ryan Sleevi, 2015/05/29 18:28:31]

Mostly a question for the enamel people - but should we omit the scheme for
something like localhost?

http://localhost and https://localhost would have different storage and
permission models (at least, that's my understanding from Rayme's thread), and
despite them both being apriori secure, they wouldn't be considered equivalent
origins (this is also reiterated in the Cookie and URL specs)

So it seems like if you're meaning to display origin, maybe eliding scheme
should only be done for SchemeIsCryptographic?

And if that is true, then like msw said, should this bool be dropped and that
logic moved internal to here? That would allow you, for example, to change the
policies on scheme-display in the future without having to update all call
sites.

Just trying to work through the eventual goal, as from an API shape, it does
seem a little weird to foist that on the caller when it sounds like really, this
is something that -enamel would unilaterally decide ("Today, we'll omit the
scheme for all https:// URLs because https:// is the new norm")

[palmer, 2015/05/29 20:40:10]

OK, I'm convinced this policy should be internal to the function. Making that
change.

+base::string16 FormatOriginForDisplay(const GURL& origin,
+                                      const std::string& languages,
+                                      bool omit_scheme);
+
 #endif  // CHROME_BROWSER_UI_ELIDE_URL_H_