I have the domain example.com
When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 redirect to **http://**main.example.com, and receives the HTML content of it.
I know how to fix it, but I´m interested in what will be happen, because main.example.com is not on https, anyone could attack (DNS replace) and respond to the 301 redirect with his malicious content.
It was a favicon redirect, so Chrome at least didn´t seem to execute the code.
I changed the main.example.com to respond
<script type="text/javascript">alert("hola") </script>
but the alert was not executed.
So is this a security flaw?