Is there really that much additional security over deleting tokens locally when logging out, but expiring all existing tokens (using a timestamp) on password change?

Blacklisting individual tokens requires storing them in the db and then looking them up each time a user logs in. It seems like given the app already uses TLS, the tiny security gain isn't big enough to justify the performance impact.

There's plenty of other relatively computationally and IO intensive activity happening during login so I can't see an extra select having a tangible impact to performance.

There exists a vulnerability, because the Peach tokens (seemingly) never expire, and thus are vulnerable to replay attacks.

However, because authorization uses TLS, it's very unlikely it will be exploited, because TLS mitigates MITM attacks.

Another commenter mentioned certificate pinning, and it Peach does this, and refuses non-secure API requests, I'd agree it's overblown. It is a vulnerability, yes, but where's the exploit?

An honest query to add on: wouldn't a nonce-style expiration digest be sufficient to prevent this hypothetical reply attack from being effective once the nonce expired?