cURL and Postman HTTP POST work, but Golang request fails with Status 400

I'm trying to send GooglePay token in a JSON via HTTP POST. The request works fine on cURL and Postman, but when I try with a Go HTTP request, the server complains that the data is in invalid format and HTTP response status code of 400.

cURL

curl --verbose --location 'https://fts-uat.cardconnect.com/cardsecure/api/v1/ccn/tokenize' \
    --header 'Content-Type: application/json' \
    --data '{
    "encryptionhandler": "EC_GOOGLE_PAY",
    "devicedata": "{\"signature\":\"MEQCIDTsnaYiwckYQFYky0i0wSn317HcKuAYrNYfh4Uw6Y4lAiAhDPxmheYFOEDGVYjVjZnPFHOrbYHwDUbkcYIxZDqU/w\\u003d\\u003d\",\"intermediateSigningKey\":{\"signedKey\":\"{\\\"keyValue\\\":\\\"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYD8gO936PEY6yEFDQolKLMcpKvjo1uZEdnKZ022tUOAERQKaEpoT6RAd6nDm1FbbFRUdionunr3vy/o72nSQ6w\\\\u003d\\\\u003d\\\",\\\"keyExpiration\\\":\\\"1701182324996\\\"}\",\"signatures\":[\"MEUCIQCbEHBbAXI/WEfguCnTkYYwgQeFZcN4/oBS8O79oQGl4wIgOmXKIihg6Ia9b7bUJckKAGrPF70fHZjCJcPGv88MMjA\\u003d\"]},\"protocolVersion\":\"ECv2\",\"signedMessage\":\"{\\\"encryptedMessage\\\":\\\"ynexar8PqRG3y1zKbNBUbbwRHbAbElnk2imema+8Zx89ex91/pgdy5ZzZKNhJ+LHJonuQKvdI9h0gWikhap7Jp6kqrnu0b4OzMxrRoj5wteUzDmm77F7WsBxi2DkIsqzcReDBZiTO3BSrJwvIkeL8mYr2yfVTZ0qY3KqCqXkzx0ANT3mZEdltqSEGOKaJKV38S1Oq0vGzQCKLxFI7Cxz5RHlTIM0WfBUigALfa+yJO4J6Tev0d4e9CYChz5DA/sBKxPf37796IxmvxxvNpytVqXYHKQWg6iAVfeKs8wbR6KA12mb6zqwTOrrLBrnLWdaBbX12flyvPFVywSJFHzTkV8WEB9mVoKrm/A2b27UV8RGFNrr9djCE1FZIgyS36VJVefLKlWQkeSGNESuLn0d7ftkv92+Gds2Hl9TQbAyy+IcGVERmQPo2EOhxf1xOpSQU8bTxLIFr+WqzGM0Q1+PquqxzQ\\\\u003d\\\\u003d\\\",\\\"ephemeralPublicKey\\\":\\\"BMAjXpWcm+kQlvIMzdhAnOJK+5RViyCaPA35gXTJGvW5pKZ6zDxD14cQYHfhccJZli24Fc+JbqnvIvtc6Yo19d8\\\\u003d\\\",\\\"tag\\\":\\\"3ZumWWU6hOw+f5V5GIKr6di4AkA0s3kzigqP3V1YzVo\\\\u003d\\\"}\"}"
}'

Go Lang

    url := "https://fts-uat.cardconnect.com/cardsecure/api/v1/ccn/tokenize"

    data := `{
        "encryptionhandler": "EC_GOOGLE_PAY",
        "devicedata": "{\"signature\":\"MEQCIDTsnaYiwckYQFYky0i0wSn317HcKuAYrNYfh4Uw6Y4lAiAhDPxmheYFOEDGVYjVjZnPFHOrbYHwDUbkcYIxZDqU/w\\u003d\\u003d\",\"intermediateSigningKey\":{\"signedKey\":\"{\\\"keyValue\\\":\\\"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYD8gO936PEY6yEFDQolKLMcpKvjo1uZEdnKZ022tUOAERQKaEpoT6RAd6nDm1FbbFRUdionunr3vy/o72nSQ6w\\\\u003d\\\\u003d\\\",\\\"keyExpiration\\\":\\\"1701182324996\\\"}\",\"signatures\":[\"MEUCIQCbEHBbAXI/WEfguCnTkYYwgQeFZcN4/oBS8O79oQGl4wIgOmXKIihg6Ia9b7bUJckKAGrPF70fHZjCJcPGv88MMjA\\u003d\"]},\"protocolVersion\":\"ECv2\",\"signedMessage\":\"{\\\"encryptedMessage\\\":\\\"ynexar8PqRG3y1zKbNBUbbwRHbAbElnk2imema+8Zx89ex91/pgdy5ZzZKNhJ+LHJonuQKvdI9h0gWikhap7Jp6kqrnu0b4OzMxrRoj5wteUzDmm77F7WsBxi2DkIsqzcReDBZiTO3BSrJwvIkeL8mYr2yfVTZ0qY3KqCqXkzx0ANT3mZEdltqSEGOKaJKV38S1Oq0vGzQCKLxFI7Cxz5RHlTIM0WfBUigALfa+yJO4J6Tev0d4e9CYChz5DA/sBKxPf37796IxmvxxvNpytVqXYHKQWg6iAVfeKs8wbR6KA12mb6zqwTOrrLBrnLWdaBbX12flyvPFVywSJFHzTkV8WEB9mVoKrm/A2b27UV8RGFNrr9djCE1FZIgyS36VJVefLKlWQkeSGNESuLn0d7ftkv92+Gds2Hl9TQbAyy+IcGVERmQPo2EOhxf1xOpSQU8bTxLIFr+WqzGM0Q1+PquqxzQ\\\\u003d\\\\u003d\\\",\\\"ephemeralPublicKey\\\":\\\"BMAjXpWcm+kQlvIMzdhAnOJK+5RViyCaPA35gXTJGvW5pKZ6zDxD14cQYHfhccJZli24Fc+JbqnvIvtc6Yo19d8\\\\u003d\\\",\\\"tag\\\":\\\"3ZumWWU6hOw+f5V5GIKr6di4AkA0s3kzigqP3V1YzVo\\\\u003d\\\"}\"}"
    }`

    req, _ := http.NewRequest(http.MethodPost, url, strings.NewReader(data))
    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }

    fmt.Println("Response Status:", resp.Status)

I've tried using nc to print all HTTP Headers and the Body from cURL, Postman and GoLang, and they look identical. I've also manipulated the User-Agent to be consistent, but no luck yet. Appreciate any help.

Solution

short answer

add this:

req.ContentLength = 0

long answer

for god knows what reason, the server only accepts Transfer-Encoding: chunked. so when you are sending a "normal" request, it looks like this and fails:

POST /cardsecure/api/v1/ccn/tokenize HTTP/1.1
Host: fts-uat.cardconnect.com
Content-Length: 1373

and when you add the above code, it looks like this and passes:

POST /cardsecure/api/v1/ccn/tokenize HTTP/1.1
Host: fts-uat.cardconnect.com
Transfer-Encoding: chunked