NSS: Handle unfriendly tokens in client auth.

content/public/browser/resource_context.h

Index: content/public/browser/resource_context.h
diff --git a/content/public/browser/resource_context.h b/content/public/browser/resource_context.h
index 7019fb715f61f9a0cd277e82b456d89ca5a086d6..0163380d26093650e9c91ae1f25d67ded59278eb 100644
--- a/content/public/browser/resource_context.h
+++ b/content/public/browser/resource_context.h
@@ -44,7 +44,8 @@ class CONTENT_EXPORT ResourceContext : public base::SupportsUserData {
   virtual net::URLRequestContext* GetRequestContext() = 0;
 
   // Get platform ClientCertStore. May return NULL.
-  virtual scoped_ptr<net::ClientCertStore> CreateClientCertStore();
+  virtual scoped_ptr<net::ClientCertStore> CreateClientCertStore(
+      const std::string& host_and_port);

[Ryan Sleevi, 2013/11/25 06:24:34]

I'm really not a fan of threading the host name up to this layer. I think the
goal should be that there's a single ClientCertStore, so that we can centrally
leverage things like platform notifications.

I admit, this is somewhat of a design nit; we could conceivably have a
ClientCertStore creation that, under the hood, used a shared object to
collaborate on things like notifications and caching, but that seems like a
pretty ugly layer of abstraction.

Would it be possible to thread the details of needing the hostname into the
ClientCertStoreNSS, so that we don't have to expose this detail to all CCS
implementations?

I'm not sure whether that would be a bound function / factory object (eg:
instead of SetPasswordDelegate, SetPasswordDelegateFactory) or simply an
interface in the implementation, but that'd avoid introducing the concept of a
"per-host" client cert store.

WDYT?

[mattm, 2013/11/26 01:15:21]

Yeah, I agree that it wasn't the cleanest approach. I've changed to the factory
method as you suggested, PTAL.

 
   // Returns true if microphone access is allowed for |origin|. Used to
   // determine what level of authorization is given to |origin| to access