share: one HTML page at a link that expires
My agents often make a chart or a mockup as one HTML file. I want to open it
on any device, and I do not want a deploy for it. So I wrote share.
How it works
I send the file with one curl call and a bearer token. The service replies
with a URL and the expiry time.
curl -sS -H "Authorization: Bearer $TOKEN" \
--data-binary @page.html "https://share.example.com/new?ttl=24h"The ttl value takes minutes, hours or days, such as 30m, 24h or 7d.
The range is 1 minute to 7 days. The default is 24 hours. The size limit is
5 MB. A DELETE call with the same token removes a page early.
Expiry without a database
The page is a file named after a random ID. The file modification time is the
expiry time. The service sets it with os.utime when it saves the page.
A request for the page checks that the modification time is in the future. A background thread removes expired files every 10 minutes. No database exists.
The ID comes from secrets.token_urlsafe(16). The link works as a secret,
so only people who have it can open the page.
A page cannot read my login
An agent wrote the page, so I treat the page as untrusted. The service sends
a Content-Security-Policy sandbox header. I left out allow-same-origin,
so the page gets an opaque origin. Its scripts cannot read cookies or storage
that belong to my other hosts under the same parent domain.
Scripts, forms, popups and downloads still work. localStorage and
document.cookie throw an error, so pages keep state in memory. The service
also sends noindex and no-referrer headers.
Size
The server is 135 lines of Python and uses only the standard library:
http.server, hmac, secrets, pathlib. It compares the token with
hmac.compare_digest.
Still open
Anyone with a link can read the page until it expires. I must never publish secrets this way. I also have no list of live pages. I would add a small listing call so I can see what is still public.