On this page
MongoDB supports automatically encrypting fields in read and write
operations when using Client-Side Field Level Encryption. You can perform automatic encryption
mongosh and official MongoDB drivers which are
compatible with version 4.2 and later. For a complete list of official
compatible drivers with support for CSFLE, see Driver
The following diagrams show how the client application and driver write and read field-level encrypted data.
For write operations, the driver encrypts field values prior to writing to the MongoDB database.
The following diagram shows the steps taken by the client application and driver to perform a write of field-level encrypted data:
For read operations, the driver encrypts field values in the query prior to issuing the read operation.
For read operations that return encrypted fields, the driver automatically decrypts the encrypted values only if the driver was configured with access to the Customer Master Key (CMK) and Data Encryption Keys (DEK) used to encrypt those values.
The following diagram shows the steps taken by the client application and driver to query and decrypt field-level encrypted data:
To enable automatic encryption, specify automatic encryption settings in
The following code snippets show how to create a client with automatic
encryption enabled in
mongosh and MongoDB drivers:
For more information on CSFLE-specific
see CSFLE-Specific MongoClient Options.
MongoDB supports using schema validation to enforce encryption of specific fields in a collection. Clients performing automatic Client-Side Field Level Encryption have specific behavior depending on the database connection configuration:
- If the connection
schemaMapobject contains a key for the specified collection, the client uses that object to perform automatic field level encryption and ignores the remote schema. At minimum, the local rules must encrypt those fields that the remote schema marks as requiring encryption.
If the connection autoEncryptionOpts
schemaMapobject does not contain a key for the specified collection, the client downloads the server-side remote schema for the collection and uses it to perform automatic field level encryption.ImportantBehavior Considerations
autoEncryptionOptsdoes not contain a key for the specified collection:
- The client trusts that the server has a valid schema with respect to automatic field level encryption.
- The client uses the remote schema to perform automatic CSFLE only. The client does not enforce any other validation rules specified in the schema.
To learn how to set up server-side CSFLE enforcement, see Server-Side Schema Enforcement.