Your application should certainly have some resolution to an account being hacked or a session token being stolen. No expiry and no denylist means an attacker

Your application should certainly have some resolution to an account being hacked or a session token being stolen. No expiry and no denylist means an attacker can cause problems until you patch your code.