Comma

Box won't preview HTML files

You put q3-analysis.html in Box because that is where company files go, shared the link, and the reply came back: "it just downloads." Or worse, it downloads and opens as source.

Box is not broken. It is doing what an enterprise content platform should.

Why storage platforms refuse to render HTML

An HTML file is a program. Rendering an arbitrary uploaded one on box.com would mean executing someone's JavaScript on a domain that holds your session — the textbook setup for stealing it. Every serious content platform draws the same line: Box, Google Drive, Dropbox, SharePoint and OneDrive all store HTML happily and none of them render it as a live page.

So the file is safe and correctly permissioned, and completely unreadable. Two symptoms follow:

  • The download doesn't open. Managed machines block .html, or open it in a text editor, or throw a "downloaded from the internet" warning that a finance director will not click through.
  • The page arrives naked. One file cannot carry the folder it came from. Stylesheets, fonts, images and chart JavaScript that sat in assets/ are simply gone. See why a shared HTML report loses its CSS.

What actually works

Keep Box for the file. Publish the report somewhere built to render it.

Comma serves report HTML inside a sandboxed iframe — allow-scripts with no allow-same-origin — so interactive charts run without getting any access to anyone's session. That is the isolation that makes rendering safe, and it is why a content platform can't do it inline.

Drag and drop. Open /new, drop the .html file in, get a URL. If the report is a folder — index.html plus assets/ — zip it and drop the zip; relative paths resolve exactly as they did locally.

Or from the job that made it:

curl -X POST https://commareports.com/api/v1/reports \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg h "$(cat q3-analysis.html)" \
        '{title:"Q3 analysis", html:$h, visibility:"domain"}')"

visibility: "domain" limits the report to your email domain — the closest match to how the file was permissioned in Box. The other levels are private, team, registered, and unlisted link for an external client.

What you get past "it renders"

  • Comments where the number is. A reader selects the cell they doubt and leaves a thread anchored to it. It survives the next publish. See commenting on HTML.
  • One URL, many revisions. PATCH the same report id next quarter; the link you already circulated shows the new version and any two revisions are diffable. No -final-v3 in anyone's downloads.
  • It opens on a phone. A rendered page works on iOS and Android, where a downloaded .html usually does not. See opening an HTML file on iPhone.

Keep Box in the loop

Nothing here asks you to move off Box. The durable pattern for regulated teams is: the artifact and its source data stay in Box under retention policy; the readable, commentable copy lives at a report URL with domain-gated access; the Box folder holds a text file with the report URL so the record points at the conversation.

Related