Separate origin from explanation in HTTP Auth dialogs.

chrome/browser/ui/login/login_prompt.cc

Index: chrome/browser/ui/login/login_prompt.cc
diff --git a/chrome/browser/ui/login/login_prompt.cc b/chrome/browser/ui/login/login_prompt.cc
index 5f8c298c9562d8a7b9ea433a2480b7ea9475138f..43327db39f96f5bf15e492e7daca03de1b067802 100644
--- a/chrome/browser/ui/login/login_prompt.cc
+++ b/chrome/browser/ui/login/login_prompt.cc
@@ -122,15 +122,14 @@ void ShowLoginPrompt(const GURL& request_url,
       languages = profile->GetPrefs()->GetString(prefs::kAcceptLanguages);
   }
 
-  base::string16 authority =
-      url_formatter::FormatUrlForSecurityDisplay(request_url, languages);
-  base::string16 explanation =
-      elided_realm.empty()
-          ? l10n_util::GetStringFUTF16(IDS_LOGIN_DIALOG_DESCRIPTION_NO_REALM,
-                                       authority)
-          : l10n_util::GetStringFUTF16(IDS_LOGIN_DIALOG_DESCRIPTION, authority,
-                                       elided_realm);
-
+  base::string16 authority = l10n_util::GetStringFUTF16(
+      IDS_LOGIN_DIALOG_AUTHORITY,
+      url_formatter::FormatUrlForSecurityDisplay(request_url, languages));

[palmer, 2015/11/19 23:01:28]

Idea: Use FormatUrlForSecurityDisplayOmitScheme iff IsOriginSecure --> true;
otherwise, FormatUrlForSecurityDisplay.

Idea: Always use FormatUrlForSecurityDisplayOmitScheme; if IsOriginSecure -->
false, use an explanation string that says "This web site is not secure" (or
other bikeshedded string).

I don't know if these are good ideas.

+  base::string16 explanation;
+  if (!elided_realm.empty()) {
+    explanation =
+        l10n_util::GetStringFUTF16(IDS_LOGIN_DIALOG_DESCRIPTION, elided_realm);

[palmer, 2015/11/19 23:01:28]

As I mentioned on the bug, I really would like to not show the realm at all. I
don't like to display untrustworthy strings in browser chrome, which should
contain only trustworthy/verified information.

+  }
   password_manager::PasswordManager* password_manager =
       handler->GetPasswordManagerForLogin();
 
@@ -139,7 +138,7 @@ void ShowLoginPrompt(const GURL& request_url,
     // A WebContents in a <webview> (a GuestView type) does not have a password
     // manager, but still needs to be able to show login prompts.
     if (guest_view::GuestViewBase::FromWebContents(parent_contents)) {
-      handler->BuildViewWithoutPasswordManager(explanation);
+      handler->BuildViewWithoutPasswordManager(authority, explanation);
       return;
     }
 #endif
@@ -156,8 +155,8 @@ void ShowLoginPrompt(const GURL& request_url,
 
   PasswordForm observed_form(
       MakeInputForPasswordManager(request_url, auth_info));
-  handler->BuildViewWithPasswordManager(explanation, password_manager,
-                                        observed_form);
+  handler->BuildViewWithPasswordManager(authority, explanation,
+                                        password_manager, observed_form);
 }
 
 }  // namespace
@@ -211,18 +210,20 @@ void LoginHandler::OnRequestCancelled() {
 }
 
 void LoginHandler::BuildViewWithPasswordManager(
+    const base::string16& authority,
     const base::string16& explanation,
     password_manager::PasswordManager* password_manager,
     const autofill::PasswordForm& observed_form) {
   password_manager_ = password_manager;
   password_form_ = observed_form;
   LoginHandler::LoginModelData model_data(password_manager, observed_form);
-  BuildViewImpl(explanation, &model_data);
+  BuildViewImpl(authority, explanation, &model_data);
 }
 
 void LoginHandler::BuildViewWithoutPasswordManager(
+    const base::string16& authority,
     const base::string16& explanation) {
-  BuildViewImpl(explanation, nullptr);
+  BuildViewImpl(authority, explanation, nullptr);
 }
 
 WebContents* LoginHandler::GetWebContentsForLogin() const {