{"id":"c307436a2e8c6c94","repo":"mongodb/node-mongodb-native","slug":"malformed-response-body-missing-field-expires-i","errorCode":null,"errorMessage":"Malformed response body - missing field `expires_in`.","messagePattern":"Malformed response body - missing field `expires_in`\\.","errorType":"exception","errorClass":"MongoCryptAzureKMSRequestError","httpStatus":null,"severity":"error","filePath":"src/client-side-encryption/providers/azure.ts","lineNumber":90,"sourceCode":"    try {\n      return JSON.parse(rawBody);\n    } catch {\n      throw new MongoCryptAzureKMSRequestError('Malformed JSON body in GET request.');\n    }\n  })();\n\n  if (status !== 200) {\n    throw new MongoCryptAzureKMSRequestError('Unable to complete request.', body);\n  }\n\n  if (!body.access_token) {\n    throw new MongoCryptAzureKMSRequestError(\n      'Malformed response body - missing field `access_token`.'\n    );\n  }\n\n  if (!body.expires_in) {\n    throw new MongoCryptAzureKMSRequestError(\n      'Malformed response body - missing field `expires_in`.'\n    );\n  }\n\n  const expiresInMS = Number(body.expires_in) * 1000;\n  if (Number.isNaN(expiresInMS)) {\n    throw new MongoCryptAzureKMSRequestError(\n      'Malformed response body - unable to parse int from `expires_in` field.'\n    );\n  }\n\n  return {\n    accessToken: body.access_token,\n    expiresOnTimestamp: Date.now() + expiresInMS\n  };\n}\n\n/**","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/client-side-encryption/providers/azure.ts#L72-L108","documentation":"Thrown when the Azure IMDS response is JSON with HTTP 200 and an access_token, but the expires_in field is missing. Without expires_in the driver cannot cache the token safely, so it refuses the response. Conforms to the Azure IMDS token response contract.","triggerScenarios":"In parseResponse() when body.access_token is truthy but body.expires_in is falsy; only when a non-standard token endpoint is used (real Azure IMDS always returns expires_in).","commonSituations":"Mock/test token endpoint that omits expires_in; a corporate proxy or alternate token service that strips fields; mismatched api-version producing a different response schema.","solutions":["If mocking the endpoint (AzureKMSRequestOptions.url), include expires_in (seconds) in the response.","Ensure no intermediary strips fields from the response body.","Use the default AZURE_BASE_URL rather than a custom url unless testing."],"exampleFix":"// mock response missing expires_in\n// after:\n{ \"access_token\": \"<token>\", \"expires_in\": 3600 }","handlingStrategy":"validation","validationCode":"// For test mocks: ensure response includes expires_in.\nconst mockResponse = JSON.stringify({ access_token: 'tok', expires_in: 3600 });","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mock token responses must include both access_token and expires_in.","Avoid altering the api-version query param that controls response schema."],"tags":["csfle","azure-kms","queryable-encryption"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}