# Does the lock widget validate the at\_hash claim for us from the Browser?

**URL:** <https://community.auth0.com/t/does-the-lock-widget-validate-the-at-hash-claim-for-us-from-the-browser/8063>\
**Category:** Get Help\
**Tags:** tokens, hash, id\_token, access-token, saml\
**Created:** [September 2, 2017, 1:37am UTC](https://community.auth0.com/t/does-the-lock-widget-validate-the-at-hash-claim-for-us-from-the-browser/8063 "2017-09-02T01:37:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tal](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@tal](https://community.auth0.com/u/tal)\
**Post date:** [September 2, 2017, 1:37am UTC](https://community.auth0.com/t/does-the-lock-widget-validate-the-at-hash-claim-for-us-from-the-browser/8063/1 "2017-09-02T01:37:04Z")

</div>

I am setting up Identity-Provider initiated SAML Login for a Single Page App using the Auth0 Lock widget. I had some trouble because the tokens we’re getting have the “at\_hash” claim that our other tokens do not. The token gets passed to our backend without the “access\_token” needed to verify the “at\_hash” claim and even though the login succeeds from the Lock Widget perspective, the user gets kicked out of the app because all requests to our backend fail.

I’ve found the naming of these two tokens a little inconsistent, so to be explicit. During the IDP handshake, the browser is redirected to call: https://our\_domain.auth0.com/login/callback?connection=our\_connection

In the response to this request, auth0 sets the following header:

```
location:url-to-our-app/?environment=dev#access_token=short_code&expires_in=86400&id_token=app_token&token_type=Bearer&state=otherstuff 

```

The “id\_token” is a jwt token with the claims we need to validate a token on our backend. The access\_token is a shorter coder which I assume is needed to verify the “at\_hash” claim in the “id\_token”.

Does the lock widget validate the at\_hash claim for us from the Browser?

Do we need to verify the at\_hash claim again on the backend? If we should, is there a standard way to pass this to the be like how we pass our id\_token in an Authorization Header on the request to our backend?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:56am UTC](https://community.auth0.com/t/does-the-lock-widget-validate-the-at-hash-claim-for-us-from-the-browser/8063/2 "2018-03-02T05:56:17Z")

</div>