How can I test, if scripting is disabled in my MongoDB - mongodb

Question

I want to make my mongoDB more secure. I read, that I can start it with --noscripting to deny JavaScript. I tried to verify, that this is working.
When I started the DB like this
mongod --dbpath /var/lib/mongodb --noscripting --fork --logpath /var/log/mongodb/mongod.log
and then I tried to use the $where-Operator like it is described here:
http://docs.mongodb.org/manual/reference/operator/query/where/
for example:
db.myCollection.find({$where: "_id == 1"})
it is returning:
Error: error: {
"$err" : "Can't canonicalize query: BadValue no globalScriptEngine in $where parsing",
"code" : 17287
}
Is this the answer, I should expect? Or is it pointing to another failure?

Answer 1

This is expected behavior since the --noscripting option disables the scripting engine and all the $where operator does is JavaScript evaluation as mention in the official documentation;
Use the $where operator to pass either a string containing a JavaScript expression or a full JavaScript function to the query system. The $where provides greater flexibility, but requires that the database processes the JavaScript expression or function for each document in the collection. Reference the document in the JavaScript expression or function using either this or obj .
Also the error message is pretty clear.
..."$err" : "Can't canonicalize query: BadValue no globalScriptEngine in $where parsing"
Note the no globalScriptEngine part of the message.