11 October 2026 · 2 min read
Sharing HTML with expiring links
A small service for sharing a chart or mockup without creating a deployment.
IOne file, another device
My coding agents often produce a chart or mockup as one HTML file. I want to open it on my phone or another computer without setting up a deployment for each draft.
I built share for that workflow. An authenticated upload returns a public URL and an expiry time. The default lifetime is 24 hours; the supported range is one minute to seven days. An authenticated delete request can remove a page earlier.
The service accepts files up to 5 MB. It is for temporary, self-contained pages rather than a full application hosting workflow.
IIExpiry without a database
Each upload becomes a file named with a random identifier. I use the file’s modification time to store its expiry, setting it with Python’s os.utime.
Every page request checks that timestamp. An expired page stops being served even if the cleanup task has not run yet. A background thread removes expired files every ten minutes.
This keeps the storage model small. It also gives modification time a special meaning: any tool that changes it can change the page’s lifetime.
IIITreat the page as untrusted
An uploaded page may contain scripts, so I do not give it the hosting site’s normal browser origin. The response includes a Content-Security-Policy sandbox without allow-same-origin.
That makes the document’s origin opaque. Its scripts cannot use document.cookie or localStorage; interactive pages keep their state in memory instead. The browser behavior is described in the CSP sandbox reference.
The service permits scripts, forms, popups, and downloads. The sandbox does not make uploaded content trustworthy or stop all network activity. I use it to limit browser privileges, not to make confidential content safe to publish.
IVA small scope
The server uses Python’s standard library for HTTP handling, files, random identifiers, and token comparison. It does not need a database.
Anyone who has the URL can read a page until it expires or I delete it. The response asks search engines not to index the page and suppresses referrer information, but those headers do not provide access control.
I still want a way to list live pages. For now, the service solves one task: move a disposable HTML draft from a local file to a link I can open elsewhere.
Adapted from my original notebook entry, published on 11 October 2026.