0

I've started my MongoDB server with the --noscripting option:

mongod --dbpath C:\MongoData --noscripting

However, I can still load JavaScript files and execute the code in them:

> load('/Users/d.banks/Documents/mongo-rocks/hello-world.js')
true
> Hello('Dave')
Hello Dave!

I assume that the script is running because it's client-side? If that's the case, what determines if a script is client or server side? If not, why is the script running?

BanksySan
  • 27,362
  • 33
  • 117
  • 216

1 Answers1

1

This ...

load('/Users/d.banks/Documents/mongo-rocks/hello-world.js')

... is an example of client-side scripting. It is client-side because it runs in the client.

The startup option --noscripting disables server-side scripting i.e. Javascript which runs on the server. Examples of this include

  • $where: the $where is a JavaScript expression or function which is executed server-side
  • $group: the $reduce, $keyf and finalize parameters are Javascript functions which are executed server-side
  • $mapreduce: the map and reduce parameters are Javascript functions which are executed server-side

So, in summary --noscripting disables server-side scripting, it has no effect on client-side scripting. Server-side scripta are those which execute on the server, with the three listed above being the prime examples.

glytching
  • 44,936
  • 9
  • 114
  • 120
  • Is it _client-side because it runs in the client_ or does it run in the client _because it's client-side_? Mind has just blown. – BanksySan Jan 16 '18 at 16:27
  • However, it's the methods the script uses that will determine where it's executed? Is there no way to force a script to run on the server? – BanksySan Jan 16 '18 at 16:28
  • There's nothing inherently client (or server) side about any Javascript expression or function. The client (or server) sided-ness is an aspect of **where** it is run. So, when you load a JS file into your client (as you showed in your question) then that is run server side but when you _pass_ a Javascript function to the server (as you can do when using $where, $group or $mapreduce) then you are asking the server to run that on your behalf and that is, therefore, server-side Javascript. – glytching Jan 16 '18 at 16:31
  • In answer to this: "Is there no way to force a script to run on the server?" ... in order for the server to run the script you need some way to _pass_ it to the server and $where / $group / $mapreduce all expose parameteers which allow you to pass JS to the server. Once passed to the server, this JS will be executed on the server. However, this: `load('/Users/d.banks/Documents/mongo-rocks/hello-world.js');` is not passed to the server and it will only ever be invoked client side. – glytching Jan 16 '18 at 16:34