Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Data Polling on the Backend for Long-Running HTTP Requests: NestJS Example

Following my previous article on long-runnig http requests handling on the frontend, I’d like to demonstrate how to implement data polling on the backend. This example uses a NestJS server app, PostgreSQL database, and Prisma ORM. However, …

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Following my previous article on long-runnig http requests handling on the frontend, I’d like to demonstrate how to implement data polling on the backend. This example uses a NestJS server app, PostgreSQL database, and Prisma ORM. However, this approach is universal and can be applied with any other programming language, framework, or database.




Here’s the workflow:




  1. A /purchase/execute HTTP request is received.

  2. A new taskId is generated, and a new entity is created in the tasks table of the database.

  3. The method responsible for purchase execution is called in the background with taskId as an argument (without waiting for its result).

  4. The server returns an HTTP 202 status and the taskId to the client.

  5. Once the purchase execution method finishes, the result is stored in the database.

  6. The client polls/purchase/execution-status/${taskId} until the status is "done", at which point the response is returned.

  7. The database is cleaned up automatically using TTL (e.g., AWS RDS with expireAt). Alternatively, you can use a Cron job to periodically remove expired tasks.




Here’s how this workflow can be implemented in NestJS:




//purchase.controller.ts

import {
Controller,
Post,
UseGuards,
Body,
Get,
Param,
Res,
HttpStatus,
} from '@nestjs/common';
import { ApiBearerAuth } from '@nestjs/swagger';
import { Response } from 'express';

import jsend from 'jsend';
import { AuthenticatedGuard } from '../auth/auth.guard';
import { PurchaseService } from './purchase.service';
import { TasksService } from '../tasks/tasks.service';

@Controller('purchase')
export class PurchaseController {
constructor(
private readonly purchaseService: PurchaseService,
private readonly tasksService: TasksService,
) {}

@UseGuards(AuthenticatedGuard)
@ApiBearerAuth()
@Post('execute')
public async executePurchase(
@Body() executePurchaseDto: { userId: string; goods: Array<{ productId: string; quantity: number }> },
@Res() res: Response,
) {
const taskId = await this.tasksService.createTask();
this.purchaseService.executePurchase(executePurchaseDto, taskId);

res.status(HttpStatus.ACCEPTED).send({ taskId, status: HttpStatus.ACCEPTED });
}

@UseGuards(AuthenticatedGuard)
@ApiBearerAuth()
@Get('execution-status/:taskId')
public async getPurchaseExecutionStatus(@Param('taskId') taskId: string, @Res() res: Response) {
const result = await this.purchaseService.getPurchaseExecutionStatus(taskId);

return res.status(HttpStatus.OK).json(jsend.success(result));
}
}










//purchase.service.ts

import { Injectable } from '@nestjs/common';
import { Task } from '@prisma/client';
import { TasksService } from '../tasks/tasks.service';

@Injectable()
export class PurchaseService {
constructor(private readonly tasksService: TasksService) {}

public async executePurchase(
executePurchaseDto: { userId: string; goods: Array<{ productId: string; quantity: number }> },
taskId: string,
): Promise<any> {
const res = await this.processPurchase(executePurchaseDto, taskId);
await this.tasksService.updateTaskById(res);
}

public async getPurchaseExecutionStatus(taskId: string): Promise<Task> {
return await this.tasksService.getTaskById(taskId);
}

public async processPurchase(
executePurchaseDto: { userId: string; goods: Array<{ productId: string; quantity: number }> },
taskId: string,
): Promise<any> {
// Your purchase handling logic here
const result = {};

return { result, taskId };
}
}










//tasks.service.ts
import { Injectable } from '@nestjs/common';
import { v4 as uuidv4 } from 'uuid';
import { PrismaService } from 'src/prisma/prisma.service';

@Injectable()
export class TasksService {
constructor(private prismaService: PrismaService) {}

public async createTask(): Promise<string> {
const currentDate = Date.now();
const createdAt = Math.floor(currentDate / 1000); // in seconds
const expireAt = createdAt + 900; // + 15 minutes

const params = {
taskId: uuidv4(),
createdAt: new Date(currentDate).toISOString(),
status: 'processing',
response: '-',
expireAt,
};

await this.prismaService.task.create({
data: {
...params,
},
});

return params.taskId;
}

public async updateTaskById({ taskId, result }): Promise<void> {
await this.prismaService.task.update({
where: { taskId },
data: { response: result, status: 'done' },
});
}
}










//prisma.service.ts

import { Injectable } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';

import { PrismaClient } from '@prisma/client';

@Injectable()
export class PrismaService extends PrismaClient {
constructor(
public configService: ConfigService,
) {
super({
datasources: {
db: {
url: configService.get('DATABASE_URL'),
},
},
});
}
}







Thanks for reading and feel free to shair your feedback)

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Data Polling on the Backend for Long-Running HTTP Requests: NestJS Example
id: a3085af8-810a-4feb-a442-29d4c1584649
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "Data Polling on the Backend fo" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Data Polling on the Backend for Long-Run")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Data Polling on the Backend for Long-Run*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Data Polling on the Backend for Long-Run"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Analyse für identifizierte Bedrohung auf Basis von Live-CTI (ENISA EUVD): CVSS 0.0 · EPSS 0.0% · CISA KEV: nein. Handlungsableitung aus den verlinkten Hersteller-Quellen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Data Polling on the Backend for Long-Running HTTP Requests: NestJS Example

Thematisch verwandte Begriffe: Data, Polling, Backend, LongRunning · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100739 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag