I just opened an idea on their ideas page: https://ideas.digitalocean.com/ideas/APPX-I-94

If you need these two options, please upvote the idea! Thank you! :)

I’m having the same issue. I want to allow certain headers in my requests. Any idea on how to solve it?

I am building an embedded app into another website. I would like to set “Access-Control-Allow-Origin” to “” and “Content-Security-Policy” to “frame-ancestors https://.xxx.com”

Is it possible to do so?

You can actually do it by download the yaml file and adding it manually.

- cors:
    allow_headers:
    - '*'
    allow_methods:
    - GET
    - OPTIONS
    - POST
    - PUT
    - PATCH
    - DELETE
    allow_origins:
    - prefix: http://localhost:3001