ajax alive after server restart

[tdi]

I know it is asynchronous, but why is it alive after server restarts ? I mean the web application. It could be a security flaw for me.

[dkarp]

Unless the account is explicitly disabled in the directory, your authentication is valid for a fixed amount of time. Restarting the server does not automatically invalidate outstanding auth tokens held by clients.

I don't see a security issue, however.

[tdi]

if the client->ajax does not use ssl connection, i can see a man in the middle attack probabilty.