Don't allow HTTP origins for the CryptoToken extension.

chrome/browser/resources/cryptotoken/signer.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview Handles web page requests for gnubby sign requests.
  *
  */
 
 'use strict';
@@ skipping 25 matching lines @@
         'browserData');
     var response = makeWebSuccessResponse(request, responseData);
     sendResponseOnce(sentResponse, queuedSignRequest, response, sendResponse);
   }
 
   var sender = createSenderFromMessageSender(messageSender);
   if (!sender) {
     sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
     return null;
   }
+  if (sender.origin.indexOf('http://') == 0 && !HTTP_ORIGINS_ALLOWED) {
+    sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
+    return null;
+  }
 
   queuedSignRequest =
       validateAndEnqueueSignRequest(
           sender, request, 'signData', sendErrorResponse,
           sendSuccessResponse);
   return queuedSignRequest;
 }
 
 /**
  * Handles a U2F sign request.
@@ skipping 19 matching lines @@
         'clientData');
     var response = makeU2fSuccessResponse(request, responseData);
     sendResponseOnce(sentResponse, queuedSignRequest, response, sendResponse);
   }
 
   var sender = createSenderFromMessageSender(messageSender);
   if (!sender) {
     sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
     return null;
   }
+  if (sender.origin.indexOf('http://') == 0 && !HTTP_ORIGINS_ALLOWED) {
+    sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
+    return null;
+  }
 
   queuedSignRequest =
       validateAndEnqueueSignRequest(
           sender, request, 'signRequests', sendErrorResponse,
           sendSuccessResponse);
   return queuedSignRequest;
 }
 
 /**
  * Creates a base U2F responseData object from the server challenge.
@@ skipping 501 matching lines @@
 
     var key = reply.responseData['keyHandle'];
     var browserData = this.browserData_[key];
     // Notify with server-provided challenge, not the encoded one: the
     // server-provided challenge contains additional fields it relies on.
     var serverChallenge = this.serverChallenges_[key];
     this.notifySuccess_(serverChallenge, reply.responseData.signatureData,
         browserData);
   }
 };