Search code examples
node.jsmongodbencryptionmongodb-nodejs-drivermongodb-csfle

MongoDB Client Side Field Level Encryption - NodeJS Driver - The keyAltNames field is not created in the Data Key Document in the local key vault

I have been following this guide - How to use MongoDB Client-Side Field Level Encryption (CSFLE) with Node.js/ to test out the MongoDB CSFLE.

In doing so, in the step of creating the data key in local key vault store https://developer.mongodb.com/how-to/client-side-field-level-encryption-csfle-mongodb-node/#create-a-data-key-in-mongodb-for-encrypting-and-decrypting-document-fields the data key successfully is created but the keyAltName is not attached to the data key’s document.

I tested this multiple times and there is nothing wrong in my code and I’m following the guide as it is. I can’t understand what is causing this issue. The data key creation is successful but without the keyAltNames field. A help here would be really appreciated.

The code related to Data Key Document Creation

async findOrCreateDataKey(client) {
      const encryption = new ClientEncryption(client, {
      keyVaultNamespace: this.keyVaultNamespace,
      kmsProviders: this.kmsProviders
      })

      await this.ensureUniqueIndexOnKeyVault(client)

      let dataKey = await client
      .db(this.keyDB)
      .collection(this.keyColl)
      .findOne({ keyAltNames: { $in: [this.keyAltNames] } })

      if (dataKey === null) {
        dataKey = await encryption.createDataKey("local", {
           keyAltNames: [this.keyAltNames]
        })
        return dataKey.toString("base64")
      }
      return dataKey["_id"].toString("base64")
   }
}

Resulting Document

enter image description here

Package JSON MongoDB Driver/ MongoDB Client Side Encryption NPM Package Versions

"mongodb": "^3.6.0",
"mongodb-client-encryption": "^1.2.1"
Solution

  • EDIT - This issue is now fixed by the MongoDB team. Refer attached issue 1.

    There is all-ready a ticket in place to fix this issue.

    Please visit following thread which was opened by my-self within MongoDB Forums to obtain more info. -> https://developer.mongodb.com/community/forums/t/nodejs-the-keyaltnames-field-is-not-created-when-creating-the-data-key-in-mongodb-client-side-field-level-encryption/15875/3

    Based on the comments in the above thread, one solution is to update the local keyVault document after its created and add the keyAltName field with its value. This seems to be the only viable fix until MongoDB team ships a fix for this in a future release.