Besically the idea of it is if someone gets their hands on a token without an expire that does not belong to them they will forever have access with that token. With an expire time that is not the case. Depending what you are using Phoenix token for it could be perfectly fine that way though.

If your use-case and threat model allow never-expiring tokens, you can opt-in by passing :infinity. That will eliminate the warning. The upcoming change and the warning are about making this opt-in rather than opt-out, to avoid mistakes due to someone missing a warning in the docs.

There are other, perhaps more likely, examples where the protection of TLS might be less than perfect. For example, in the past CAs have been compromised and fake certificates issued to intercept communications. This might only affect users in a certain country or using a certain ISP.

The point is, relying on tokens that can never ever be revoked is a risk, no matter how hard you try to protect them. Giving users an option to revoke their own tokens using the DB-backed mechanism I described might be wise, to add another layer of protection.