#883 Add option to disable CSRF tokens

package.json

@@ -53,6 +53,7 @@
     "version": "1.9.4",
     "scripts": {
         "start": "node server.js",
+        "start-multi": "node server.js --disableCsrf",
         "pkg": "pkg --compress Gzip --no-bytecode --public ."
     },
     "bin": {

public/script.js

@@ -524,7 +524,11 @@ const system_messages = {
 
 $(document).ajaxError(function myErrorHandler(_, xhr) {
     if (xhr.status == 403) {
-        toastr.warning("doubleCsrf errors in console are NORMAL in this case. Just reload the page or close this tab.", "Looks like you've opened SillyTavern in another browser tab", { timeOut: 0, extendedTimeOut: 0, preventDuplicates: true });
+        toastr.warning(
+            "doubleCsrf errors in console are NORMAL in this case. If you want to run ST in multiple tabs, start the server with --disableCsrf option.",
+            "Looks like you've opened SillyTavern in another browser tab",
+            { timeOut: 0, extendedTimeOut: 0, preventDuplicates: true },
+        );
     }
 });
 

server.js

@@ -34,7 +34,11 @@ if (net.setDefaultAutoSelectFamily) {
 }
 
 const cliArguments = yargs(hideBin(process.argv))
-    .option('ssl', {
+    .option('disableCsrf', {
+        type: 'boolean',
+        default: false,
+        describe: 'Disables CSRF protection'
+    }).option('ssl', {
         type: 'boolean',
         default: false,
         describe: 'Enables SSL'
@@ -308,6 +312,7 @@ const directories = {
 };
 
 // CSRF Protection //
+if (cliArguments.disableCsrf === false) {
     const doubleCsrf = require('csrf-csrf').doubleCsrf;
 
     const CSRF_SECRET = crypto.randomBytes(8).toString('hex');
@@ -333,6 +338,14 @@ app.get("/csrf-token", (req, res) => {
 
     app.use(cookieParser(COOKIES_SECRET));
     app.use(doubleCsrfProtection);
+} else {
+    console.warn("\nCSRF protection is disabled. This will make your server vulnerable to CSRF attacks.\n");
+    app.get("/csrf-token", (req, res) => {
+        res.json({
+            "token": 'disabled'
+        });
+    });
+}
 
 // CORS Settings //
 const cors = require('cors');