How are the «secureUrlList» and «excludedUrlList» arguments injected to the \Magento\Framework\Url\SecurityInfo's constructor?

The secureUrlList argument in etc/frontend/di.xml defines the URLs which should be secure (use HTTPS) if the «General» → «Web» → «Base URLs (Secure)» → «Use Secure URLs on Storefront» option is enabled.

The excludedUrlList defines the URLs which should not be secure even if the «Use Secure URLs on Storefront» option is enabled.

1. Magento_Authorizenet

2. Magento_Checkout

3. Magento_Contact

4. Magento_Downloadable

5. Magento_Multishipping

6. Magento_Newsletter

7. Magento_Paypal

8. Magento_Persistent

9. Magento_Review

10. Magento_Sales

11. Magento_Wishlist

See also: