← Airbnb Interview Insights

Airbnb·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say
May 2026

Summary

Airbnb system design round focused entirely on offline-capable reservation systems. Dense question, lots of moving parts, left the room not totally sure I covered everything they wanted.

Questions Asked (1)

Q1

Design an offline-capable reservation feature for a mobile/web app. Cover what gets stored in IndexedDB, how a Service Worker intercepts network requests, background sync and retry logic, cache versioning and invalidation, conflict resolution on reconnect, security concerns like encryption at rest and key management, token refresh, PII minimization, and XSS/CSRF protections. Also describe how you'd test and audit the whole thing.

System DesignTechnical Trade-offsAPI & Integrations
Author's notes

This was basically five questions stapled together.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and constraints (e.g., offline duration, data types, security needs). Then walk through the architecture layer by layer: storage (IndexedDB), network interception (Service Worker), sync/retry, conflict resolution, security, and testing. Emphasize trade-offs and justify decisions with Airbnb-specific context (e.g., high user trust, global scale).

Pro tip: Frame your answer around user trust and data integrity: Airbnb users expect seamless booking even offline, so prioritize idempotent operations and clear conflict resolution to avoid double-bookings. Also, mention that security is not just about encryption but also about minimizing attack surface (e.g., short-lived tokens, strict CSP).

1. Clarify Requirements and Constraints

Ask about expected offline duration, types of reservations (e.g., hotel, experience), data sensitivity, and compliance (GDPR, PCI). Define success metrics like sync success rate and conflict frequency.

2. Design Offline Storage and Sync

Outline what to store in IndexedDB (e.g., reservation drafts, user preferences, cached listings) and how to structure it for efficient queries. Describe Service Worker strategies (cache-first for static assets, network-first for API calls with fallback to IndexedDB).

3. Implement Background Sync and Conflict Resolution

Explain using Background Sync API with exponential backoff and retry limits. Detail conflict resolution strategies (e.g., last-write-wins with versioning, or server-side merge) and how to handle failures (e.g., user notification, manual resolution).

4. Address Security and Privacy

Cover encryption at rest (e.g., Web Crypto API with keys stored in secure enclave or derived from user credentials), token refresh (using refresh tokens with rotation), PII minimization (store only necessary data, anonymize where possible), and XSS/CSRF protections (CSP, SameSite cookies, CSRF tokens).

5. Plan Testing and Auditing

Describe unit tests for sync logic, integration tests with mocked network conditions, end-to-end tests using tools like Puppeteer, and security audits (penetration testing, static analysis). Include monitoring for sync failures and conflict rates in production.

Key Points to Mention

  • IndexedDB schema design: object stores for reservations, sync queue, and metadata; use indexes for efficient lookups.
  • Service Worker lifecycle: install, activate, fetch events; cache versioning with cache names and cleanup of old caches.
  • Background Sync API with exponential backoff and jitter; fallback to periodic sync or manual retry.
  • Conflict resolution: use versioning (e.g., ETags) and server-side merge; consider operational transforms for collaborative editing.
  • Security: encrypt sensitive data at rest using Web Crypto; store keys in non-extractable CryptoKey or derive from user passphrase; use HttpOnly, Secure, SameSite cookies for tokens.
  • Testing: simulate offline/online transitions, network throttling, and race conditions; audit with OWASP ZAP and dependency scanning.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.