Definition
Remember being a kid on a long car trip, asking “Are we there yet?” every five minutes? That’s polling. Your parents didn’t proactively tell you when you’d arrive - you kept asking at regular intervals. In the API world, polling works exactly the same way: the client repeatedly asks the server “Anything new?” at fixed intervals, whether or not there’s actually new data to report.
Polling is the simplest form of getting updates from a server because it uses plain HTTP requests that work everywhere. The client sets up a timer, fires a request every X seconds, checks if the response contains anything new, and processes it. No special protocols, no persistent connections, no firewall headaches. The server treats each request like any other - stateless and simple. This universality is why polling remains popular despite being inefficient: it works in every browser, behind every corporate firewall, through every proxy.
The problem with polling is waste. If you poll every 5 seconds and data changes once per hour, 719 out of 720 requests return nothing new. Each request consumes bandwidth, server CPU, database queries, and mobile battery - all for “nope, nothing yet.” This is why polling suits scenarios where simplicity trumps efficiency, updates are reasonably frequent, or real-time precision isn’t critical. For a weather app that updates hourly, polling every 10 minutes is fine. For a stock trading app where milliseconds matter, polling is the wrong tool.
Example
Polling powers countless applications where simplicity and compatibility outweigh the need for real-time updates:
Email Clients Checking for New Mail: When you open Gmail or Outlook on your phone, it doesn’t maintain a constant connection to the server. Instead, it polls every few minutes: “Any new emails?” The server returns either new messages or an empty response. Most email apps let you configure the polling interval - more frequent means faster notification but more battery drain.
Social Media Feed Refresh: When you pull down to refresh Instagram or Twitter, you’re triggering an immediate poll. But even when you’re not pulling, the app periodically polls the server in the background to update your feed, check for new notifications, and fetch updated story lists. The “new posts available” banner appears when a poll returns new content.
IoT Device Monitoring: Smart home dashboards poll sensors regularly. Your Nest thermostat might poll every 30 seconds to check temperature, your security camera controller polls every minute for motion events, your smart meter polls hourly for energy usage. Each sensor is too simple to maintain WebSocket connections, so polling fits perfectly.
CI/CD Build Status: When you push code to GitHub and wait for your build to complete, GitHub’s UI polls the build status API every few seconds. That spinning circle isn’t connected to the build server in real-time - it’s your browser asking “Done yet? Done yet? Done yet?” until the build finishes.
Flight Tracker Apps: Flightradar24 and similar apps poll aircraft position APIs. Every few seconds, they request updated positions for all tracked flights. The data changes constantly but not in real-time - flight positions update every few seconds anyway, so polling at that rate is perfectly adequate.
Analogy
The Mailbox Check: You check your physical mailbox every afternoon at 5 PM. Sometimes there’s mail, sometimes there isn’t. You have no way of knowing whether the mail carrier came without checking. This is polling - you check on a schedule regardless of whether there’s anything new. A push-based alternative would be a notification when mail arrives.
The “Are We There Yet?” Kid: On a road trip, a child asks “Are we there yet?” every five minutes. The parents don’t proactively announce arrival - the child keeps asking at intervals. Most of the time the answer is “no,” but eventually it’s “yes.” The wasted questions are the cost of not having a better notification system.
Manually Refreshing a Webpage: Before web apps auto-updated, you’d hit F5 to refresh news sites. You’d check CNN every few minutes to see if there was breaking news. Most refreshes showed the same content, but occasionally there’d be something new. You were the polling mechanism, hitting refresh at human intervals.
The Oven Timer Check: When baking without a timer, you periodically open the oven to check if the cake is done. You can’t know without checking, so you check every few minutes. Each check lets heat escape (overhead), and most checks show “not done yet” (wasted effort). A timer would push the notification to you instead.
The Night Security Guard: A security guard does rounds every hour, checking each door and window. Most rounds find everything normal. The guard can’t know if something changed without checking. Contrast this with motion sensors that would notify the guard only when something actually happens - push instead of poll.
Diagram
sequenceDiagram
participant C as Client
participant S as Server
loop Every 5 seconds
C->>S: GET /api/updates
Note right of S: Check for data
S->>C: 200 OK (empty)
Note over C: Wait 5s...
C->>S: GET /api/updates
Note right of S: Check for data
S->>C: 200 OK (empty)
Note over C: Wait 5s...
C->>S: GET /api/updates
Note right of S: New data!
S->>C: 200 OK {"message": "Hello"}
Note over C: Process data
Note over C: Wait 5s...
C->>S: GET /api/updates
Note right of S: Check for data
S->>C: 200 OK (empty)
end
Note over C,S: Most requests return empty
(inefficient but simple)
Code Example
// Simple polling implementation
setInterval(async () => {
try {
const response = await fetch('/api/notifications');
const data = await response.json();
if (data.notifications.length > 0) {
displayNotifications(data.notifications);
}
} catch (error) {
console.error('Polling error:', error);
}
}, 10000); // Poll every 10 seconds
Security Notes
CRITICAL: Long polling is inefficient alternative to WebSockets. Use WebSockets or Server-Sent Events instead.
Polling Techniques:
- Short polling: Frequent requests (inefficient)
- Long polling: Server waits before responding
- Exponential backoff: Increase poll interval over time
- Jitter: Add randomness to prevent thundering herd
Resource Costs:
- Network overhead: Frequent requests waste bandwidth
- Server resources: Many open connections consume resources
- Client battery: Frequent polling drains mobile battery
- Latency: Polling introduces delay before client sees update
Security:
- Authentication: Each request must authenticate
- Rate limiting: Limit polling frequency
- Session hijacking: Long connection vulnerable to hijacking
- CSRF: Include CSRF tokens in polling requests
Best Practices:
- Minimize polling: Use push mechanisms (WebSockets, SSE) when possible
- Adaptive intervals: Increase interval when no updates
- Backoff: Implement exponential backoff
- Jitter: Add randomness to prevent synchronized polls
- Timeout: Close inactive connections