Golang Base64 signature verification VS CryptoJS - go

Question

I am trying to convert a Node.js script to Golang. However, I always get the error "error: illegal base64 data at input byte 40" while decoding Base64. May someone help me, already debug and read documentation for few hours... Help is needed!
// Node.js exampe (code copied from Facebook Instant game SDK example)
const CryptoJS = require('crypto-js');
var firstpart = signedRequest.split('.')[0];
firstpart = firstpart.replace(/-/g, '+').replace(/_/g, '/');
const signature = CryptoJS.enc.Base64.parse(firstpart).toString(); // <-- fail here
const dataHash = CryptoJS.HmacSHA256(signedRequest.split('.')[1], '<APP_SECRET>').toString();
var isValid = signature === dataHash;
const json = CryptoJS.enc.Base64.parse(signedRequest.split('.')[1]).toString(CryptoJS.enc.Utf8);
const data = JSON.parse(json);
Code above is the sample code from Facebook, and the following code (below) is written by me.
parts := strings.Split(signedRequest, ".")
firstPart := parts[0]
replaced := strings.Replace(firstPart, "-", "+", -1)
replaced = strings.Replace(replaced, "_", "/", -1)
signatureByte, err := base64.StdEncoding.DecodeString(replaced) // <-- ERROR here
if err != nil {
fmt.Println("error:", err)
return false, err
}
signature := string(signatureByte)
dataHash := createHmacSHA256(parts[1], "<APP_SECRET>") // TODO: not sure, to string or hex string?
isValid := signature == dataHash
if isValid {
return true, nil
}
The Go Playground is at here https://play.golang.org/p/ilSbqamFdV_-

Answer 1

First of all, get rid of the strings.Replaces and just use base64.URLEncoding instead of StdEncoding, since the URL alphabet is clearly what your data is in.
Also, standard base64 data is padded, but your data is not padded, so you need the "raw" encoding, i.e. base64.RawURLEncoding. This works:
firstPart := parts[0]
signatureByte, err := base64.RawURLEncoding.DecodeString(firstPart)
https://play.golang.org/p/Pj_LLfirU8M
See the base64 package docs and the base64 standard for more info.