In our web app, we enable users to upload files, and preview them. We also enable them to upload from their cloud drives, such as Google Drive, DropBox, and OneDrive.Most of our users are using OneDrive for businesses.

In order to show the selected files, we are saving embeddable links from the cloud drives, and embedding them in an iframe, that way the permissions, and authorization are in the cloud derive control.

I tried using the request: POST /drives/{driveId}/items/{itemId}/preview, after the user selects the file from the file picker, and I using the getUrl field from the response payload to embed the file into an iframe. (the getURL as src)

I noticed that the URL contains access_token, and I deleted it before saving it, and I noticed that the iframe still works fine, and allows only users with permission to see the file, is this is a good usage of that?

In the Graph API docs, driveItem:preview mention that the driveItem:preview request generates a short-lived URL, I would like to know what is the expiration of the link (hour, day, week, month, etc..). is it short-lived only because of the access_token, and authorized users in Sharepoint/Onedrive will have access for the long term?

Are there any pitfalls that I didn't notice?

I have to be sure that it is a robust way for using that otherwise, I will save broken links, and the users will have to pick again all the files..

  • I would recommend raising a GitHub issue with the documentation to get a reliable answer to how long the short lived embeddable URL exists for. This is quite easy to do, just go to the bottom of the page and click the "This Page" under "Submit and view feedback for". Commented Apr 20, 2021 at 22:16
  • Thanks, I already raised it, and just notice that someone answer me partially.
    – ykorach
    Commented Apr 21, 2021 at 11:26


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.