Merge pull request #1769 from gchq/revert-1753-jsonwebtoken-vuln

Author: a3957273

package-lock.json

@@ -135,7 +135,7 @@
     "jsesc": "^3.0.2",
     "json5": "^2.2.3",
     "jsonpath-plus": "^8.0.0",
-    "jsonwebtoken": "^9.0.0",
+    "jsonwebtoken": "8.5.1",
     "jsqr": "^1.4.0",
     "jsrsasign": "^11.1.0",
     "kbpgp": "2.1.15",

package.json

@@ -50,12 +50,7 @@ class JWTSign extends Operation {
 
         try {
             return jwt.sign(input, key, {
-                algorithm: algorithm === "None" ? "none" : algorithm,
-
-                // To utilize jsonwebtoken 9+ library and maintain backwards compatibility for regression tests
-                // This could be turned into operation args in a future PR
-                allowInsecureKeySizes: true,
-                allowInvalidAsymmetricKeyTypes: true
+                algorithm: algorithm === "None" ? "none" : algorithm
             });
         } catch (err) {
             throw new OperationError(`Error: Have you entered the key correctly? The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.