I just join a project, and while browsing the code, I realize that some links redirect to another web page, in HTTP instead of HTTPS.
The linked website has an https version, and there was no reason to not use it so I fix the issue.
However, the first website is on production, so we should avoid rebuilding the whole server for minor correction but rather wait to regroup several minor fixes.
I'm just wondering if this is a minor fix, or if leading users to an HTTP website is a major problem.
The linked website is a showcase website belonging to the company I work for, and there is no interaction such as logging into an account, so I guess while man in the middle attack is still possible, there is no sensible content/data to steal. Besides that, the link is in the footer of the first website, and the website itself doesn't have major traffic, so the number of people clicking it shouldn't be that high
How critical is it? Can such issue wait several days, or should it be fixed as soon as possible?