user: use base64.URLEncoding for passwords

internal/db/paste.go

@@ -24,7 +24,7 @@ type Paste struct {
 	ID          uint       `gorm:"primaryKey"`
 	Type        PasteType  `gorm:"index"`
 	State       PasteState `gorm:"index"`
-  CreatedBy   uint       `gorm:"index"`
+	CreatedBy   uint       `gorm:"index"`
 	Content     []byte
 	Key         string `gorm:"uniqueIndex"`
 	DeleteToken string

internal/db/user.go

@@ -84,8 +84,8 @@ func HashPassword(password string) (string, error) {
 	hash := argon2.IDKey([]byte(password), salt, 2, 64*1024, 1, pwdHashSize)
 
 	// Encode the salt and hash as a string in PHC format
-	encodedSalt := base64.RawStdEncoding.EncodeToString(salt)
+	encodedSalt := base64.URLEncoding.EncodeToString(salt)
-	encodedHash := base64.RawStdEncoding.EncodeToString(hash)
+	encodedHash := base64.URLEncoding.EncodeToString(hash)
 	return fmt.Sprintf("$%s$%s$%s$%s", pwdAlgo, pwdParams, encodedSalt, encodedHash), nil
 }
 
@@ -98,11 +98,11 @@ func comparePassword(hashedPassword string, password string) (bool, error) {
 	encodedSalt, encodedHash := fields[2], fields[3]
 
 	// Decode the salt and hash from base64
-	salt, err := base64.RawStdEncoding.DecodeString(encodedSalt)
+	salt, err := base64.URLEncoding.DecodeString(encodedSalt)
 	if err != nil {
 		return false, err
 	}
-	hash, err := base64.RawStdEncoding.DecodeString(encodedHash)
+	hash, err := base64.URLEncoding.DecodeString(encodedHash)
 	if err != nil {
 		return false, err
 	}