跪拜 Guibai
← All articles
Frontend · GitHub · JavaScript

Embed CAD Drawings Without Shipping Files to a Third-Party Server

By mlightcad ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Most embedded CAD viewers route drawings through a vendor's cloud, which breaks data-residency promises and creates a compliance headache for firms handling confidential plans. A client-side-only viewer eliminates that exposure at the architectural level, not through policy wording.

Summary

A new iframe-based CAD viewer lets any site display DWG and DXF drawings by pointing at a public URL. The file is fetched and rendered client-side — no upload, no proxy, no backend conversion cluster. The default review mode gives users measurement and annotation tools while blocking edits and new geometry creation. Because the byte path runs from your host directly to the visitor's browser, the architecture itself enforces data locality, which matters for architecture firms, factories, and any product where drawings are confidential assets. The only operational requirement is a permissive CORS header on the file host, a trade-off that keeps the viewer zero-backend.

Takeaways
An iframe pointing to a public DWG or DXF URL renders the drawing entirely in the visitor's browser with no server-side processing.
Default review mode permits pan, zoom, measurement, and annotation but blocks all edits and entity creation.
Query parameters control mode (review/read/write), viewport (extents or saved), language, theme, toolbar, and command-line visibility.
The drawing host must serve appropriate CORS headers if it differs from the embedding page's origin.
MLightCAD's cad-viewer stack handles DWG/DXF parsing, WebGL rendering, and editing logic without a CAD server; the iframe plugin is the embeddable delivery surface for that stack.
Conclusions

Shifting CAD rendering to the browser turns a privacy policy question into an infrastructure question — if the file never leaves your CDN, there is no third party to trust or audit.

Defaulting embeds to review mode rather than full edit is a small design choice that prevents a large class of accidental damage when drawings are shared with clients or the public.

The CORS requirement is the only operational friction, and it's a deliberate trade-off: configure one header on your own host instead of managing an upload pipeline to a vendor cloud.

Concepts & terms
Review mode
A viewer state that allows panning, zooming, measuring, and annotating a CAD drawing while preventing any modification to the geometry or creation of new entities.
CORS (Cross-Origin Resource Sharing)
A browser security mechanism that controls whether a web page can request resources from a different origin. For the iframe plugin to fetch a DWG file, the file's host must include an Access-Control-Allow-Origin header permitting the embedding site.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗