Design Link Preview

Problem Scope and Product Goals for Link Preview

Link preview generation is a distributed workflow where the message send path must remain fast while preview enrichment executes asynchronously through safe network boundaries. The design uses canonical URL keys, cache-first lookup, isolated fetch workers, metadata extraction, policy-based sanitization, and evented delivery to hydrate clients once preview artifacts are ready. Interview-grade answers should connect user experience goals to p95 latency, extraction success rate, cache-hit ratio, and abuse containment policies.

Link preview generation introduces a distributed contract problem: clients author structured content, backend policy services validate it, and rendering paths must reproduce identical output across web, mobile, and notification surfaces. This section defines invariants for authoring, persistence, and rendering so interviews stay concrete and implementation-ready.

We enforce deterministic normalization, bounded render budgets, and policy-driven sanitization to block script injection, malformed nesting, and denial-of-service style payloads. We also track a strict compatibility matrix so older clients can safely degrade unsupported blocks into canonical plaintext fallbacks without data loss.

Architecture decisions are expressed with measurable SLO impact, data model implications, and migration paths that keep deployment risk low while teams ship new preview primitives rapidly.

Operational details

• Define ownership boundaries between composer, validator, preview renderer, and delivery services.
• Capture idempotency for retries and deduplication in event-driven render pipelines.
• Instrument policy rejects and render fallbacks with error taxonomy labels.

Why interviewers care

Link Preview interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

The failure that defines the design

The outage to narrate is SSRF. Your service fetches whatever URL a user pastes, so an attacker pastes a link to your cloud provider's metadata endpoint or an internal service, and your fetcher dutifully retrieves it and surfaces (or logs) the secrets — credentials leaked because the server made a request it never should have. The fix is the spine of the design: isolate the fetcher in a network that cannot reach internal infrastructure, validate every URL by resolving its DNS and rejecting private, link-local, and loopback ranges, and re-check after each redirect. State SSRF-hardened isolated fetching up front, because a link-preview service is fundamentally a controlled outbound-request engine pointed at the whole internet, and the catastrophic failure is that engine being aimed back at your own network.