func validateHeaderConfig(headers map[string]string) error {
HeadersLoop:
	for k, v := range headers {
		values, ok := extraHTTPHeaders[k]
		if !ok {
			return fmt.Errorf("HTTP header %q can not be configured", k)
		}
		for _, allowedValue := range values {
			if v == allowedValue {
				continue HeadersLoop
			}
		}
		if len(values) > 0 {
			return fmt.Errorf("invalid value for %s. Expected one of: %q, but got: %q", k, values, v)
		}
	}
	return nil
}
validateHeaderConfig checks that the provided header configuration is correct.
It does not check the validity of all the values, only the ones which are
well-defined enumerations.
package web
import (
	"encoding/hex"
	"fmt"
	"net/http"
	"sync"
	"github.com/go-kit/log"
	"golang.org/x/crypto/bcrypt"
)
var extraHTTPHeaders = map[string][]string{
	"Strict-Transport-Security": nil,
	"X-Content-Type-Options":    {"nosniff"},
	"X-Frame-Options":           {"deny", "sameorigin"},
	"X-XSS-Protection":          nil,
	"Content-Security-Policy":   nil,
}
func validateUsers(configPath string) error {
	c, err := getConfig(configPath)
	if err != nil {
		return err
	}
	for _, p := range c.Users {
		_, err = bcrypt.Cost([]byte(p))
		if err != nil {
			return err
		}
	}
	return nil
}