In our web app, we enable users to upload files, and preview them. We also enable them to upload from their cloud drives, such as Google Drive, DropBox, and OneDrive.Most of our users are using OneDrive for businesses.
In order to show the selected files, we are saving embeddable links from the cloud drives, and embedding them in an iframe, that way the permissions, and authorization are in the cloud derive control.
I tried using the request: POST /drives/{driveId}/items/{itemId}/preview, after the user selects the file from the file picker, and I using the getUrl field from the response payload to embed the file into an iframe. (the getURL as src)
I noticed that the URL contains access_token, and I deleted it before saving it, and I noticed that the iframe still works fine, and allows only users with permission to see the file, is this is a good usage of that?
In the Graph API docs, driveItem:preview mention that the driveItem:preview request generates a short-lived URL, I would like to know what is the expiration of the link (hour, day, week, month, etc..). is it short-lived only because of the access_token, and authorized users in Sharepoint/Onedrive will have access for the long term?
Are there any pitfalls that I didn't notice?
I have to be sure that it is a robust way for using that otherwise, I will save broken links, and the users will have to pick again all the files..