What does setting the "-server" flag do?

Question

I'm running the GUI version of Bitcoin Core. But I want to also be able to interact with bitcoin-cli in my Windows console. Apparently I need to set the -server flag before running bitcoin-qt, or set server=1 in the config file. (I notice I can also tick a box in the GUI that says "Enable RPC Server" - I suppose that does the same thing?)

But I don't understand what this is actually doing behind the scenes. What does it mean that it's running as a "server", as opposed to not being a server?

Are there any downsides to doing this, particularly on the security/privacy front?

Also, I'm curious as to why I'm required to have a username/password if wanting to use bitcoin-cli?

Answer 1

bitcoin-cli (and other software) communicates with Bitcoin Core using the so-called JSON-RPC protocol.

If you start Bitcoin Core as bitcoind (without GUI), that protocol is enabled by default (because otherwise there'd be no way to interact with it). If you start Bitcoin Core as bitcoin-qt (with GUI), that protocol is disabled by default (because the assumption is that the user will be using the GUI to interact with it). If you want to use both the GUI and the JSON-RPC protocol, you need to start bitcoin-qt with the -server argument.

In recent versions (since 2015 or so), you don't need to configure a username/password - bitcoin-cli can use "cookie authentication" instead to get access. Configuring a username/password is mostly useful if you want to have other external software talk to Bitcoin Core that doesn't support cookie authentication, or if you want to talk to Bitcoin Core over the network (cookie authentication only works on the local machine itself, from the same user).

If you do set a username/password, and pick an insecure one, there may be a risk. An attacker that gets access to the RPC interface can do anything - including stealing your money.