diff --git a/cmd/dex/config.go b/cmd/dex/config.go
index 9df7a96a..a328d66e 100644
--- a/cmd/dex/config.go
+++ b/cmd/dex/config.go
@@ -150,7 +150,7 @@ type Web struct {
 	TLSCert        string   `json:"tlsCert"`
 	TLSKey         string   `json:"tlsKey"`
 	AllowedOrigins []string `json:"allowedOrigins"`
-    AllowedHeaders []string `json:"allowedHeaders"`
+	AllowedHeaders []string `json:"allowedHeaders"`
 }
 
 // Telemetry is the config format for telemetry including the HTTP server config.
diff --git a/cmd/dex/serve.go b/cmd/dex/serve.go
index 9e045038..38395fc6 100644
--- a/cmd/dex/serve.go
+++ b/cmd/dex/serve.go
@@ -265,7 +265,7 @@ func runServe(options serveOptions) error {
 		AlwaysShowLoginScreen:  c.OAuth2.AlwaysShowLoginScreen,
 		PasswordConnector:      c.OAuth2.PasswordConnector,
 		AllowedOrigins:         c.Web.AllowedOrigins,
-        AllowedHeaders:         c.Web.AllowedHeaders,
+		AllowedHeaders:         c.Web.AllowedHeaders,
 		Issuer:                 c.Issuer,
 		Storage:                s,
 		Web:                    c.Frontend,
diff --git a/server/server.go b/server/server.go
index c26e5e50..bb9da17b 100644
--- a/server/server.go
+++ b/server/server.go
@@ -77,8 +77,8 @@ type Config struct {
 	// domain.
 	AllowedOrigins []string
 
-    // List of allowed headers for CORS requests on discovery, token, and keys endpoint.
-    AllowedHeaders []string
+	// List of allowed headers for CORS requests on discovery, token, and keys endpoint.
+	AllowedHeaders []string
 
 	// If enabled, the server won't prompt the user to approve authorization requests.
 	// Logging in implies approval.
@@ -217,9 +217,9 @@ func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy)
 	if len(c.SupportedResponseTypes) == 0 {
 		c.SupportedResponseTypes = []string{responseTypeCode}
 	}
-    if len(c.AllowedHeaders) == 0 {
-        c.AllowedHeaders = []string{"Authorization"}
-    }
+	if len(c.AllowedHeaders) == 0 {
+		c.AllowedHeaders = []string{"Authorization"}
+	}
 
 	allSupportedGrants := map[string]bool{
 		grantTypeAuthorizationCode: true,