Attachment reader and Office preview
The message reader displays stored attachments with original download and read-only previews. Office files use the configured Collabora service, local or remote according to placement. A remote renderer receives scoped access to file bytes through WOPI. It does not receive a general S3 URL.
Supported files and limits
| File type | Preview |
|---|---|
Word .doc, .docx | Read-only Collabora |
Excel .xls, .xlsx | Read-only Collabora |
PowerPoint .ppt, .pptx | Read-only Collabora |
| Browser PDF viewer | |
| PNG, JPEG, GIF, WebP | Browser image viewer |
| MP3, WAV, Ogg, supported MP4 audio | Native audio controls, subject to browser codecs |
| MP4, WebM video | Native video controls |
Markdown .md, .markdown, text/markdown | Markdown with GitHub Flavored Markdown |
HTML .html, .htm, text/html | Isolated read-only document |
| Code and plain text | Scoped syntax highlighting or escaped source |
All built-in previews accept at most 25,000,000 bytes, including the exact limit. This is the stored file size, not the expanded content of an Office ZIP. MIME allowlists and browser codecs still restrict playback. Download remains available for unsupported, corrupt, or oversized files.
A supported Office filename extension takes priority. Extensionless names can use one of six supported Office MIME types. The preview name receives the inferred extension. Original download names remain unchanged. Macro-enabled extensions are excluded and CODE macro execution is disabled. There is no edit, save, rename, or save-as flow.
Text, Markdown, and HTML
Markdown supports tables and task lists. It skips raw HTML, replaces images with alternative text, and renders links as non-navigable labels. It does not fetch external resources automatically.
HTML uses srcDoc in an iframe with an empty sandbox. Preparation removes scripts, iframes, objects, embeds, base/meta/link elements, templates, and noscript elements. It also removes event, navigation, and fetch attributes. The content security policy blocks scripts, external resources, form actions, and base URLs. Inline styles and Base64 PNG/JPEG/GIF/WebP images can remain.
The HTTP attachment route sends raw HTML as a download with application/octet-stream. The UI fetches bounded content and isolates its rendering.
The text renderer loads only when opened. Markdown, HTML, and code requests use preview=true. Syntax selection uses an explicit highlight.js lexer without autodetection and scoped GitHub light/dark themes.
Supported extensions: js, jsx, mjs, cjs, ts, tsx, json, css, scss, sql, py, sh, bash, ps1, xml, yaml, yml, c, h, cpp, hpp, cs, java, go, rs, php, rb, toml, ini, txt, log.
MIME fallbacks: text/plain, application/json, application/xml, text/xml, text/css, application/javascript. Unknown lexers show escaped text.
Above 200,000 bytes, text preview skips rich Markdown/HTML parsing and syntax highlighting. It shows escaped source within the overall 25,000,000-byte limit. This browser-processing limit does not change original download.
Data access and authorization
The backend normalizes Graph arrays, onboarding {items} manifests, and legacy filename manifests. It checks the active message, mailbox ownership, and associated nondeleted attachment. S3 and legacy database bytes are supported.
Native preview fetches authenticated BFF bytes and creates a browser Blob URL. Closing or replacing the preview releases that URL.
Office preview requests a session through same-origin POST /api/mail/attachments/office-session. The BFF checks session, explicit connected-account ownership, attachment access, and size. It builds the viewer URL from validated CODE discovery paths and the configured BFF HTTPS origin.
Each WOPI CheckFileInfo/GetFile checks token scope/expiry, current account/mailbox ownership, permissions, and content hash. A changed file needs a new preview session. WOPI exposes read routes only, and metadata forbids writes. Original download remains a separate action.
Backend preview=true checks metadata and actual byte size. S3 reads check Content-Length and the arriving stream. Oversize returns HTTP 413. Token-bearing WOPI/CODE routes disable access logging. Never copy their tokens into a report.
Runtime and existing installations
The root deployment includes pinned Collabora CODE without an application host port. Current memory limits come from the selected runtime profile, not a fixed attachment-guide total. See memory reference.
CODE is the development edition. A production deployment needs a supported edition and its own capacity/compatibility checks. Self-hosting does not establish vendor production support.
Normal initialization prepares signing material and starts selected dependencies. For an existing installation, preserve data and use ordinary or scoped lifecycle. Do not reset storage to add preview. Inspect host capacity first.
Proxy routes
Browser assets and document WebSockets reach Collabora through the BFF origin. Expose only required viewer/discovery routes. Keep administration and direct conversion APIs private. The WOPI allowlist must match the selected callback policy.
A remote renderer additionally requires remote callback preparation. Check the actual document page, file read, and original download after a change. A socket error can indicate callback failure rather than a browser connection failure.