This question already has an answer here:
I came across this scenario recently, where a mobile application used for banking is sending HTTP requests for GIF images and HTTPS requests for all other transactions. But the requests to the GIF images are sent to a different domain and requests to bank related transactions are sent to another different domain. Does this behavior of this application pose any security risks?
I mean, can the http request & response be tampered to perform any kind of attacks?
If possible, how can this be exploited?