Disable AltSvc from insecure origin.

net/http/http_stream_factory_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl.h"
 
 #include <string>
 
 #include "base/logging.h"
 #include "base/stl_util.h"
@@ skipping 171 matching lines @@
 
 AlternativeService HttpStreamFactoryImpl::GetAlternativeServiceFor(
     const HttpRequestInfo& request_info,
     HttpStreamRequest::Delegate* delegate,
     HttpStreamRequest::StreamType stream_type) {
   GURL original_url = request_info.url;
 
   if (original_url.SchemeIs("ftp"))
     return AlternativeService();
 
+  if (!session_->params().enable_alternative_service_for_insecure_origins &&
+      !original_url.SchemeIs("https"))
+    return AlternativeService();
+
   url::SchemeHostPort origin(original_url);
   HttpServerProperties& http_server_properties =
       *session_->http_server_properties();
   const AlternativeServiceVector alternative_service_vector =
       http_server_properties.GetAlternativeServices(origin);
   if (alternative_service_vector.empty())
     return AlternativeService();
 
   bool quic_advertised = false;
   bool quic_all_broken = true;
@@ skipping 170 matching lines @@
     return true;
 
   if (session_->params().transport_security_state->IsGooglePinnedHost(host))
     return true;
 
   return ContainsKey(session_->params().quic_host_whitelist,
                      base::ToLowerASCII(host));
 }
 
 }  // namespace net