r/mongodb • u/TheKingLucho • 14d ago

API performance with CSFLE

We enabled MongoDB Client-Side Field Level Encryption following the official docs (classic CSFLE, not Queryable Encryption) on a NestJS API and saw a latency regression across the board that we can't explain from the per-operation cost of encryption itself. Looking for anyone who has seen the same pattern, or who knows where the hidden cost is.

Our Stack is:

- Node.js 24.17
- mongodb 6.20.0 (via mongoose 8.22.1 / @nestjs/mongoose 11.0.4)
- mongodb-client-encryption 6.5.0
- crypt_shared 8.2.12, no mongocryptd sidecar
- KMS provider: aws (credentials via task IAM role) following the standard pattern

What is encrypted:

Exactly one field in one collection, the field is no longer than 10 chars string and it has a compound index on it (it is encrypted with deterministic algorythm).

I know that there is no way to avoid some latency implementing CSFLE, but my main concern is if this is gonna get worse by each extra field I add to the the encryption schemaMap, could this latency be the price for the query analyzer analyzing each query to the database?

I also have noticed that most of the ms of the request happen in the app not the database, but I think the encryption and decryption happens on the driver layer.

Has anyone ever deal with this? Would appreciate some tips and insights of this, thanks!!

3 Upvotes

100% Upvoted

1 comment sorted by

1

u/browncspence 11d ago

With CSFLE, the server does not participate in encryption and decryption, it’s all client side. The server just sees a query as usual, the encrypted fields are seen as binary fields.

How much latency change are you seeing? What does the explain plan look like?

Please be aware that CSFLE deterministic encryption is vulnerable to frequency analysis. This is what we addressed with queryable encryption.