I know. But it’s possible that a man in the middle uses such a browser initiated http connection to add a cookie vie http. Later, the cookie is sent from the browser via https - and the man in the middle knows the session cookie.
That works. The http status (404, 301, 410, 500) isn’t relevant.
That’s
not a problem. The favicon isn’t a user initiated link, the user adds only the http link to the site without https.
Simple solution: No preview if the destination is http. Then it’s not required to load the favicon.