Set SSL info when an HTTP auth dialog is triggered by direct navigation.

chrome/browser/ui/login/login_prompt.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/login/login_prompt.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/lock.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/password_manager/chrome_password_manager_client.h"
 #include "chrome/browser/prerender/prerender_contents.h"
 #include "chrome/browser/tab_contents/tab_util.h"
 #include "chrome/browser/ui/login/login_interstitial_delegate.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/password_manager/content/browser/content_password_manager_driver.h"
 #include "components/password_manager/core/browser/browser_save_password_progress_logger.h"
 #include "components/password_manager/core/browser/password_manager.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/resource_dispatcher_host.h"
 #include "content/public/browser/resource_request_info.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/ssl_status.h"
+#include "grit/generated_resources.h"
 #include "net/base/auth.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_util.h"
 #include "net/http/http_transaction_factory.h"
+#include "net/ssl/ssl_info.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/gfx/text_elider.h"
 
 using autofill::PasswordForm;
 using content::BrowserThread;
 using content::NavigationController;
 using content::RenderViewHost;
 using content::RenderViewHostDelegate;
@@ skipping 504 matching lines @@
   // closed, so that interstitial should only be a login interstitial.
   if (is_main_frame && (parent_contents->ShowingInterstitialPage() ||
                         parent_contents->GetLastCommittedURL().GetOrigin() !=
                             request_url.GetOrigin())) {
     // Show a blank interstitial for main-frame, cross origin requests
     // so that the correct URL is shown in the omnibox.
     base::Closure callback = base::Bind(&ShowLoginPrompt,
                                         request_url,
                                         make_scoped_refptr(auth_info),
                                         make_scoped_refptr(handler));
+    content::NavigationEntry* pending_entry =
+        parent_contents->GetController().GetPendingEntry();
+    ui::PageTransition transition = pending_entry->GetTransitionType();
+    // For non-user initiated navigations, auth dialog is displayed when the
+    // visible url points to the page that initiated the navigation and not the
+    // actual auth url. Update the pending entry in that case.
+    content::NavigationEntry* entry =
+        (transition & ui::PAGE_TRANSITION_FROM_ADDRESS_BAR)
+            ? parent_contents->GetController().GetVisibleEntry()
+            : pending_entry;

[meacer, 2015/03/12 20:37:48]

Not sure if this is the best way to check for renderer-initiated navigations.

[Charlie Reis, 2015/03/13 18:19:37]

This won't work for determining renderer-initiated.  There's a
NavigationEntryImpl::is_renderer_initiated() for that, but we haven't had to
expose it outside content/ yet.

The new code here also feels fragile to me, since the conditions in which
GetVisibleEntry() and GetPendingEntry() differ are very subtle.  I haven't
re-read the whole CL, but was there a reason we couldn't just use the pending
entry in all cases (if that's what has the actual URL and SSL state for the auth
request)?

[meacer, 2015/03/17 17:30:44]

I initally used is_renderer_initiated() but realized the layering violation at
the last minute so resorted to these hacks.
Interesting, using the pending entry indeed works! I'm almost sure it didn't
work back then, but it seems like a lot has changed (and in a good way)

+    const content::SSLStatus& ssl_status = entry->GetSSL();
     // This is owned by the interstitial it creates. It cancels any existing
     // interstitial.
-    new LoginInterstitialDelegate(parent_contents,
-                                  request_url,
+    new LoginInterstitialDelegate(parent_contents, request_url, ssl_status,
                                   callback);
   } else {
     ShowLoginPrompt(request_url,
                     auth_info,
                     handler);
   }
 }
 
 // ----------------------------------------------------------------------------
 // Public API
 
 LoginHandler* CreateLoginPrompt(net::AuthChallengeInfo* auth_info,
                                 net::URLRequest* request) {
   bool is_main_frame = (request->load_flags() & net::LOAD_MAIN_FRAME) != 0;
   LoginHandler* handler = LoginHandler::Create(auth_info, request);
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&LoginDialogCallback, request->url(),
                  make_scoped_refptr(auth_info), make_scoped_refptr(handler),
                  is_main_frame));
   return handler;
 }