SSLStatus contains a SecurityStyle member. SecurityStateModel uses the |security_style|, in addition to some other information from the SSLStatus, to compute a SecurityLevel for the page. (SecurityLevel is a finer-grained enum containing some states that reflect Chrome-specific policy.)
However, where things get confusing is that SecurityStateModel converts SecurityLevels back into SecurityStyles for the purpose of conveying page security state to DevTools. So in some cases, the SSLStatus will have a SecurityStyle which gets converted into a SecurityLevel which gets converted back into a *different* SecurityStyle than we started with.
To alleviate the confusingness, I propose that we remove the |security_style| member from SSLStatus. |security_style| is a simple calculation from a couple of pieces of information that are already on the SSLStatus (see GetSecurityStyleForResource), so embedders can easily recompute it themselves.
I think this will be a good simplification as it will leave SecurityStyle with the single purpose of conveying security state from the embedder to DevTools. (As opposed to the two purposes it has now: conveying security state from //content to the embedder *and* conveying security state with embedder-specific policy applied from the embedder to DevTools.)
Comment 1 by bugdroid1@chromium.org
, Oct 11 2016