In production apps, the code would probably get transferred to the server at compilation/bundling/release time. The cluent would only need to send some kind of hash that uniquely identifies the function to call, as well as supply the arguments.