Disable AltSvc from insecure origin.

net/http/http_stream_factory_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl.h"
 
 #include <string>
 
 #include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
@@ skipping 199 matching lines @@
 
 AlternativeService HttpStreamFactoryImpl::GetAlternativeServiceForInternal(
     const HttpRequestInfo& request_info,
     HttpStreamRequest::Delegate* delegate,
     HttpStreamRequest::StreamType stream_type) {
   GURL original_url = request_info.url;
 
   if (original_url.SchemeIs("ftp"))
     return AlternativeService();
 
+  if (!session_->params().enable_alternative_service_for_insecure_origins &&
+      !original_url.SchemeIs("https"))

[Ryan Hamilton, 2016/05/31 23:43:42]

nit: I think this should probably have {}s since the if is more than one line.

[Bence, 2016/06/01 10:54:38]

Sorry, I missed this.  Will do in a follow-up.

+    return AlternativeService();
+
   url::SchemeHostPort origin(original_url);
   HttpServerProperties& http_server_properties =
       *session_->http_server_properties();
   const AlternativeServiceVector alternative_service_vector =
       http_server_properties.GetAlternativeServices(origin);
   if (alternative_service_vector.empty())
     return AlternativeService();
 
   bool quic_advertised = false;
   bool quic_all_broken = true;
@@ skipping 170 matching lines @@
     return true;
 
   if (session_->params().transport_security_state->IsGooglePinnedHost(host))
     return true;
 
   return ContainsKey(session_->params().quic_host_whitelist,
                      base::ToLowerASCII(host));
 }
 
 }  // namespace net