Setting Access-Control-Allow-Origin in my space doesn't work with *

Worth noting that if you have CDN enabled, it looks as though you might have to clear the cache for CORS changes to take affect.

Hey! Thanks for providing the screenshot!

The CORS settings for your Spaces is working and here is the curl output:

curl -v -X OPTIONS  'https://go-edit.sfo2.digitaloceanspaces.com/1/1565117740336-dog.g-1q0nvMe.jpeg' -H "Origin:https://localhost" -H "Access-Control-Request-Method: GET,PUT,POST,HEAD,DELETE"
*   Trying 138.68.32.225...
* TCP_NODELAY set
* Connected to go-edit.sfo2.digitaloceanspaces.com (138.68.32.225) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate: *.sfo2.digitaloceanspaces.com
* Server certificate: DigiCert SHA2 Secure Server CA
* Server certificate: DigiCert Global Root CA
> OPTIONS /1/1565117740336-dog.g-1q0nvMe.jpeg HTTP/1.1
> Host: go-edit.sfo2.digitaloceanspaces.com
> User-Agent: curl/7.54.0
> Accept: */*
> Origin:https://localhost
> Access-Control-Request-Method: GET,PUT,POST,HEAD,DELETE
> 
< HTTP/1.1 200 OK
< Access-Control-Allow-Origin: https://localhost
< Vary: Origin
< Access-Control-Allow-Methods: GET,PUT,POST,HEAD,DELETE
< Access-Control-Max-Age: 0
< x-amz-request-id: tx000000000000112633397-005d52a396-23e283-sfo2a
< Content-Length: 0
< Date: Tue, 13 Aug 2019 11:48:38 GMT
< Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
< 
* Connection #0 to host go-edit.sfo2.digitaloceanspaces.com left intact