Embedding settings

Some ShapeDiver accounts let users embed online models in external websites and applications, either through iframe embedding or through direct embedding using the viewer API.

Each ShapeDiver account only allows embedding in a limited number of external domains, which varies depending on the type of account. In the “Settings” screen of the user dashboard, users can check how many external domains are enabled for their account, as well as add and/or remove domains from their list. They can also enforce strong authorization for all embedded models of their account.

Domain whitelist

In this subsection, users can add and remove domains from the list of allowed domains for embedding.

Domain formatting

Enter the hostname, including a non-standard port. Do not enter a scheme such as http:// or https://. The rules below decide which hosts a stored name allows.

• A stored registrable domain allows that host and the same host with one leading www label.

• The same rule includes a public suffix of more than one label. A stored example.co.uk allows example.co.uk and www.example.co.uk.

• A stored subdomain, such as sub.example.com, does not allow www.sub.example.com.

• A stored www host does not allow the apex. A stored www.example.com does not allow example.com.

• Add any subdomain other than www as its own entry. A stored example.com does not allow blog.example.com.

• Letter case does not matter. A stored Example.CO.UK allows example.co.uk and www.example.co.uk. The settings list can keep the spelling that was saved.

Local testing

You can add local hostnames and ports in order to set up a local development environment (e.g. localhost:8081 or 127.0.0.1:8080). Those domains do not count towards your domain limit, therefore you can setup as many as you want.

Domains of the form *.local and *.localhost (with optional ports as well) also do not count towards your domain limit.

Security

In this subsection, users can decide whether they want to enforce strong authorization for all embedded models.

Require strong authorization

If this setting is turned on, any embedded model will be protected through a secure JWT mechanism, about which you can read more here. In this case, it will not be possible to disable strong authorization on a per-model basis.

If this setting is turned off, you will still have the ability to turn strong authorization on and off directly in the model edit page of each model, in the Developers settings.