Verify Google Sign-in token in Golang

main.go

package main

import (
	"context"
	"fmt"
	"google.golang.org/api/idtoken"
	"log"
	"net/http"
)

func main() {
	http.HandleFunc("/", handleMain)
	http.HandleFunc("/tokenSignIn", handleTokenSignIn)
	fmt.Println("Server started at http://localhost:8080")
	http.ListenAndServe(":8080", nil)
}

func handleMain(w http.ResponseWriter, r *http.Request) {
	http.ServeFile(w, r, "index.html")
}

// Verify Google ID token: https://developers.google.com/identity/gsi/web/guides/verify-google-id-token
func handleTokenSignIn(_ http.ResponseWriter, r *http.Request) {
	// parse POST form
	if err := r.ParseForm(); err != nil {
		log.Fatalln(err)
	}

	// verify CSRF tokens
	const csrfCookieKey = "g_csrf_token"
	cookieToken, err := r.Cookie(csrfCookieKey)
	if err != nil {
		log.Fatalf("failed to retrieve %s from cookie: %s", csrfCookieKey, err)
	}
	formCookie := r.PostForm.Get(csrfCookieKey)
	if formCookie == "" {
		log.Fatalf("no %s in POST form", csrfCookieKey)
	}
	if cookieToken.Value != formCookie {
		log.Fatalln("failed to verify double submit cookie")
	}

	// validate Google token using their library
	payload, err := idtoken.Validate(context.Background(), r.PostForm.Get("credential"), googleClientId)
	if err != nil {
		log.Fatalln(err)
	}
	fmt.Print(payload.Claims)
}