Is the lack of blocklisting support for invalid tokens a serious threat?

Question

I have been ramping up on Django Rest Framework and JWT authentication through tutorials that point to django-rest-framework-jwt but while researching how to customize JWT validation, realized that there is a newer implementation django-rest-framework-simplejwt.

The older jwt package does not have a commit since 2017 but simple-jwt is actively maintained and developed, and from what I can find, has better security features. It is also the recommended link in the DRF documentation.

I could not find a relevant post on S/O but I found that JoelGoh92 in this git issue summarizes the problem well:

1. In most JWT implementations, an access token + a refresh token is returned. Otherwise the other option, if only a single token is desired, is the sliding token approach. With simple-jwt, the jwt can be configured to either of these implementations, whichever is required.

2. With the current django-rest-framework-jwt supported by rest-auth, the only approach available is similar to the sliding token approach, except that it has no way to blacklist a previously generated jwt token, e.g. by logout on user end. On the other hand, simple-jwt provides a way to perform this blacklisting of invalid tokens.

I'm curious to know whether the lack of "blocklisting" support for invalid (logged out) tokens is a serious threat and I (DRF JWT community) should migrate to simple-jwt.