Skip to main content
Question

⚠️ Critical Issue: My Figma Make site suddenly broke due to new CSP + CORS behavior (worked fine before)

  • November 24, 2025
  • 8 replies
  • 120 views
Imtiyaz_Ahmed

Hi team,

My project on Figma Make suddenly stopped working today even though I made absolutely no changes to the code or settings. The production site was working perfectly until a few hours ago.

Now I’m seeing two major issues simultaneously, which strongly suggests that a recent platform-side update in Figma Make caused this.

1️⃣ CORS failures on ALL fetch requests to my Supabase Edge Functions
 

Every API request from my frontend to Supabase now fails with this error:

Access to fetch at 'https://fkfqsvrjzpebwkwtqcfr.supabase.co/functions/v1/...' from origin 'https://barracks.imtiyazahmed.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Browser logs:

Network error on /ideas: TypeError: Failed to fetch Network error on /quests: TypeError: Failed to fetch Network error on /migrate/...: TypeError: Failed to fetch

This affects every single endpoint:

  • /migrate/sealing-to-designing

  • /quests

  • /ideas

  • /ideas/counts/all

These routes were working fine for days.
I did not redeploy anything.
I did not change my Supabase functions.

Now the preflight OPTIONS requests are failing before they even hit my backend.

This suggests that Figma Make changed how fetch / CORS / preflight is handled internally.

2️⃣ New Content Security Policy now blocks JavaScript evaluation

I also now receive this CSP error on every load

Content Security Policy of your site blocks the use of 'eval' in JavaScript. The directive 'script-src' does not allow 'unsafe-eval'.

This error did NOT appear previously and breaks parts of the app.

I cannot modify CSP headers in Figma Make, so this strongly suggests that:

Figma Make recently pushed a stricter default CSP (script-src 'self')

This now blocks:

  • eval()

  • new Function()

  • any external library that uses eval internally

  • certain bundlers’ runtime code

Again, this was not happening before today.

3️⃣ Summary of symptoms

  • Site worked fine for days

  • No deployments, no code changes

  • Today, all API calls fail with CORS

  • New CSP errors suddenly appear

  • Looks like a platform update changed security behavior

Both failures happening at the exact same time strongly indicate a platform-side change in Figma Make’s runtime, CSP, or request proxying.

4️⃣ What I need from the Figma Make team

  1. Can you confirm if there was a CSP or networking update today?

  2. Did the default CSP recently change to block eval?

  3. Did fetch preflight / proxying behavior change?

  4. Is there a way to view or override the generated CSP policy?

  5. Is this a bug, or an intentional tightening of security?

My entire app is currently broken, and many others may be affected if this is a global update.

5️⃣ Additional context

Frontend domain:
https://barracks.imtiyazahmed.com

Backend (Supabase Edge Functions):
https://fkfqsvrjzpebwkwtqcfr.supabase.co/functions/v1/...

Everything worked perfectly until today.

After today’s change, the browser blocks ALL API calls + runtime JS.

If needed, I can provide a live demo URL, devtools recordings, CSP header dump, or Supabase logs.

Thanks — looking forward to your response.

8 replies

Imtiyaz_Ahmed
  • Imtiyaz_Ahmed
  • Author
  • Active Member
  • November 24, 2025

​@Celine_ ​@ksn THIS IS URGENT!

Imtiyaz_Ahmed
  • Imtiyaz_Ahmed
  • Author
  • Active Member
  • November 24, 2025

Update:

  1. The websites started working but there is still some CSP, and CORS issues. 
  2. After deep analysis I have figured it was due to some changes within the environment of FIGMA MAKE which are out of my reach
ksn
Figmate
  • ksn
  • Community Support
  • November 24, 2025

Hi ​@Imtiyaz_Ahmed - glad to hear things are running (albeit with some issues still), but have asked our engineering team to review your post and look into this.

What changes did you notice that are not within your ability to reach?

Apologies, but I can’t guarantee a timeline of response. I will update you as soon as I am able.

Imtiyaz_Ahmed
  • Imtiyaz_Ahmed
  • Author
  • Active Member
  • November 24, 2025

Hi ​@Imtiyaz_Ahmed - glad to hear things are running (albeit with some issues still), but have asked our engineering team to review your post and look into this.

What changes did you notice that are not within your ability to reach?

Apologies, but I can’t guarantee a timeline of response. I will update you as soon as I am able.

Yeah it worked but againt the same thing happened later on for 15 minutes. 

I didn’t get to attend the issue immediately because of some other work though I found that the core issue was the same. Based on the console error received, the problems were “updated CORS and CSP Policies”

After researching these, I found out that CSP Headers are established in the hosting servers which currently are in access to FIGMA (wherever FIGMA MAKE is hosted) Its not something that I can access. Though I managed to fix the CORS issues in the code, the CSP issues stayed and were the main factors to my site going down.

According to Chatgpt and Claude, CSP errors occur when some changes are reflected on the server or environment i.e FIGMA SERVERS

Also no rush on the response. I am committed to making Figma and Figma Make better. They are my livelyhood and I love figma. Make enabled me to do so many things and hence I would always prefer staying active in terms of making it better

ksn
Tom Reem
Tom Reem
Figmate
  • Tom Reem
  • Figmate
  • November 24, 2025

Hey ​@Imtiyaz_Ahmed — Tom here jumping in for ​@ksn to help keep things moving. Thank you for the added detail; it’s really useful for our team as we look into what’s happening on your end.

We’ve connected with our engineering team, and having access to the file where this is occurring will really help us take a closer look. I just sent an email your way with next steps — when you have a moment, please check your inbox for ticket number: 1614596.

Again, we appreciate you flagging this so thoughtfully, and your commitment to making Figma and Make better. We’ll stay with you as we work toward a clear answer.

ksn
Dustin_Kemper

I’m having similar issues with my Make prototype. Was working fine today until about an hour ago (~ 1:20pm MST). Now I’m getting `GET https://agdpvthokaitlnocubau.supabase.co/functions/v1/make-server-53da9eb3/catalog/full net::ERR_CERT_AUTHORITY_INVALID` followed by `TypeError: Failed to fetch`

Lana Space
  • Lana Space
  • New Member
  • November 25, 2025

I have the same problem.

 

I have azurecontainerapps from which I get data via curl location.

 

But yesterday, the data stopped coming through and I got the error message: ‘Unfortunately, I cannot make external HTTP requests to the Apicurio API directly. I don't have a tool to perform curl or fetch to external services The problem is that a direct request in the browser works, but fetch from JavaScript gets a 403. This is a classic problem with headers or CORS preflight..’

 

Everything was fine yesterday.

Tom Reem
Figmate
  • Tom Reem
  • Figmate
  • December 2, 2025

Hi ​@Dustin_Kemper and ​@Lana Space — thank you both for adding your experience here. Your details help us understand the scope of what’s happening.

Are you still seeing the same errors on your end? If the issue is ongoing, our engineering team is actively reviewing similar reports, and we’d like to take a closer look at the specific files tied to the published domains you mentioned. If you’re open to it, let me know — our Technical Quality team can collaborate with you to investigate what’s driving the behavior.

Once I hear back, I’ll follow up with next steps for securely sharing file access.

Thanks for staying engaged as we work through this together.

Terms & ConditionsCookie settingsAccessibility statement