mongodb/node-mongodb-native · error · MongoCryptAzureKMSRequestError

Malformed response body - missing field `expires_in`.

Error message

Malformed response body - missing field `expires_in`.

What it means

Thrown when the Azure IMDS response is JSON with HTTP 200 and an access_token, but the expires_in field is missing. Without expires_in the driver cannot cache the token safely, so it refuses the response. Conforms to the Azure IMDS token response contract.

Source

Thrown at src/client-side-encryption/providers/azure.ts:90

    try {
      return JSON.parse(rawBody);
    } catch {
      throw new MongoCryptAzureKMSRequestError('Malformed JSON body in GET request.');
    }
  })();

  if (status !== 200) {
    throw new MongoCryptAzureKMSRequestError('Unable to complete request.', body);
  }

  if (!body.access_token) {
    throw new MongoCryptAzureKMSRequestError(
      'Malformed response body - missing field `access_token`.'
    );
  }

  if (!body.expires_in) {
    throw new MongoCryptAzureKMSRequestError(
      'Malformed response body - missing field `expires_in`.'
    );
  }

  const expiresInMS = Number(body.expires_in) * 1000;
  if (Number.isNaN(expiresInMS)) {
    throw new MongoCryptAzureKMSRequestError(
      'Malformed response body - unable to parse int from `expires_in` field.'
    );
  }

  return {
    accessToken: body.access_token,
    expiresOnTimestamp: Date.now() + expiresInMS
  };
}

/**

View on GitHub (pinned to 3366c21a63)

Solutions

1. If mocking the endpoint (AzureKMSRequestOptions.url), include expires_in (seconds) in the response.
2. Ensure no intermediary strips fields from the response body.
3. Use the default AZURE_BASE_URL rather than a custom url unless testing.

Example fix

// mock response missing expires_in
// after:
{ "access_token": "<token>", "expires_in": 3600 }

// For test mocks: ensure response includes expires_in.
const mockResponse = JSON.stringify({ access_token: 'tok', expires_in: 3600 });

When it happens

Trigger: In parseResponse() when body.access_token is truthy but body.expires_in is falsy; only when a non-standard token endpoint is used (real Azure IMDS always returns expires_in).

Common situations: Mock/test token endpoint that omits expires_in; a corporate proxy or alternate token service that strips fields; mismatched api-version producing a different response schema.

Related errors

• Malformed JSON body in GET request.
• Unable to complete request.
• Malformed response body - missing field `access_token`.
• Malformed response body - unable to parse int from `expires_
• [Azure KMS] ${error.message}

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/c307436a2e8c6c94.json. Report an issue: GitHub.