-
Type:
Improvement
-
Resolution: Unresolved
-
Priority:
Minor - P4
-
None
-
Affects Version/s: None
-
Component/s: None
-
None
-
Server Security
-
Server Security 2025-08-29, Server Security 2025-09-12, Server Security 2025-09-26
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Proposal If a collection configured with encryptedFields is dropped, also drop state collections: enxcol_.<coll>.esc, and enxcol_.<coll>.ecoc
Background & Motivation
Creating a collection for Queryable Encryption (QE) requires drivers also create state collections (full example):
coll = encrypted_client["db"].create_collection("coll", encryptedFields=encrypted_fields) # Created `coll`, `enxcol_.coll.esc`, and `enxcol_.coll.ecoc`
Dropping a QE collection on an encrypted MongoClient requires drivers drop state collections:
coll.drop()
# Dropped `coll``, `enxcol_.coll.esc`, and `enxcol_.coll.ecoc`
However, if a collection is accidentally dropped with an unencrypted MongoClient, the state collections remain:
unencrypted_client = MongoClient() unencrypted_client["db"]["coll"].drop() # Only drops `coll`!
This results in orphaned collections.
Create Collection creates all collections describes the reason creating QE collections does not create the state collections on the server:
If create collection in FLE 2 creates 4 collections and 1 secondary index in one create collection invocation this breaks the assumptions of tools like MongoRestore/MongoSync/MongoMirror in that one call to createCollection creates one collection.
However, this rationale may not apply to drop.