Can I set custom HTTP response headers, specifically Content-Security-Policy and X-Frame-Options, on a site published through Figma Make?

Hey, ​@mikej722! Thanks for your post and great question. 

I’m checking with the team to see if this is possible, although it’s not currently supported with Figma Sites and my tentative answer is that Figma Make also does not support this (I will update this if I find out differently, though!). What is your use case for setting those? It would be helpful to know that as general feedback either way. Thanks!

Thanks for checking!

Use case is a web app with user accounts, so there's a login flow, plus a few third party SDKs (maps, payments, analytics).

CSP is mainly so I can lock down which domains scripts and network calls are allowed to come from, rather than leaving it wide open. X-Frame-Options (or frame-ancestors) is to stop the app being iframed on someone else's site, which is the usual clickjacking concern once you've got a login screen.

Both of these show up on pretty much any standard security checklist, so I'm trying to figure out whether an app with real auth can ship on Make directly, or if it needs to sit behind something like Cloudflare that can add the headers on the way out.

Worth noting the meta http-equiv tag only handles part of CSP and doesn't work for frame-ancestors at all, so there's no way to do it from inside the page.

Would be great to see either a headers option or some secure defaults baked in.