There is no violation of RFC 2616. Two points: 1. The implementors RFC 2616 is concerned with are: (i) of the server involved in a connection, (ii) of the cli

There is no violation of RFC 2616. Two points: 1. The implementors RFC 2616 is concerned with are: (i) of the server involved in a connection, (ii) of the client to that connection, and (iii) of the network that joins the two. Facebook's involvement as a server ended before these connections became live, and so is not one of (i)-(iii). 2. The notion of safety here is in the sense that inserting arbitrary get requests into a sequence of transactions between client and server will not change the semantics of those transactions. It does not have anything to do with what code the user might have asked the browser to run on receipt of the results of a GET request. See, e.g., Mozilla's documentation of HTTP: A safe method is a method that doesn't have any side-effects on the server, from https://developer.mozilla.org/en/HTTP#Safe_methods https://developer.mozilla.org/en/HTTP#Safe_methods