Shoul I consider <a href></a> as dangerous mixed passive content?

Question

From mozilla

Mixed passive/display content is content served over HTTP that is included in an HTTPS webpage, but that cannot alter other portions of the webpage. For example, an attacker could replace an image served over HTTP with an inappropriate image or message to the user. The attacker could also infer information about the user's activities by watching which images are served to the user; often images are only served on a specific page within a website. If the attacker observes HTTP requests to certain images, they could determine which webpage the user is visiting. Passive content list

This section lists all types of HTTP requests which are considered passive content:

<img> (src attribute)
<audio> (src attribute)
<video> (src attribute)
<object> subresources (when an <object> performs HTTP requests)

It seems to me that the content loaded through HTTP within the HTTPS page is considered vulnerable. In this scenario the HTTP image (for example) is loaded without user interaction.

Should I consider dangerous also elements like <a href=http://link>More info</a> which require a user to click on them?

Answer 1

Should I consider <a href></a> as dangerous mixed passive content?

While this is not considered mixed content (since it is not embedded into the page), it can of course still be dangerous: with a plain HTTP link an attacker could hijack the request or response and provide different content. And usually there is an expectation by the user that an offered link will not lead to some dangerous content (unless it is clearly dangerous based on the context). Thus, it is best to offer the links only as HTTPS.