From ec109c8645902f85cd38e793b39c8bef6d21024f Mon Sep 17 00:00:00 2001
From: Yogesh Chaudhary <yogesh.chaudhary@okta.com>
Date: Wed, 17 Dec 2025 11:43:41 +0530
Subject: [PATCH] fix: prevent unnecessary user object updates causing infinite
 loops

Uses lodash-es isEqual for deep equality comparison to check if user
content has changed, preventing unnecessary state updates and infinite
loops in useEffect hooks.

Changes:
- Added lodash-es dependency for deep equality checking
- Updated GET_ACCESS_TOKEN_COMPLETE and HANDLE_REDIRECT_COMPLETE cases
- State only updates when user content actually changes

Fixes #787
---
 package-lock.json | 27 ++++++++++++++++++++++++++-
 package.json      |  4 +++-
 src/reducer.tsx   |  3 ++-
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7d13b0df..a3f21b6c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,8 @@
       "version": "2.11.0",
       "license": "MIT",
       "dependencies": {
-        "@auth0/auth0-spa-js": "^2.11.0"
+        "@auth0/auth0-spa-js": "^2.11.0",
+        "lodash-es": "^4.17.22"
       },
       "devDependencies": {
         "@rollup/plugin-node-resolve": "^15.0.1",
@@ -19,6 +20,7 @@
         "@testing-library/jest-dom": "6.8.0",
         "@testing-library/react": "16.3.0",
         "@types/jest": "^29.5.14",
+        "@types/lodash-es": "^4.17.12",
         "@types/react": "19.1.8",
         "@types/react-dom": "19.1.6",
         "@typescript-eslint/eslint-plugin": "^8.36.0",
@@ -1682,6 +1684,23 @@
         "parse5": "^7.0.0"
       }
     },
+    "node_modules/@types/lodash": {
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-FOvQ0YPD5NOfPgMzJihoT+Za5pdkDJWcbpuj1DjaKZIr/gxodQjY/uWEFlTNqW2ugXHUiL8lRQgw63dzKHZdeQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/lodash-es": {
+      "version": "4.17.12",
+      "resolved": "https://registry.npmjs.org/@types/lodash-es/-/lodash-es-4.17.12.tgz",
+      "integrity": "sha512-0NgftHUcV4v34VhXm8QBSftKVXtbkBG3ViCjs6+eJ5a6y6Mi/jiFGPc1sC7QK+9BFhWrURE3EOggmWaSxL9OzQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/lodash": "*"
+      }
+    },
     "node_modules/@types/node": {
       "version": "22.10.6",
       "dev": true,
@@ -8458,6 +8477,12 @@
       "version": "4.17.21",
       "license": "MIT"
     },
+    "node_modules/lodash-es": {
+      "version": "4.17.22",
+      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.22.tgz",
+      "integrity": "sha512-XEawp1t0gxSi9x01glktRZ5HDy0HXqrM0x5pXQM98EaI0NxO6jVM7omDOxsuEo5UIASAnm2bRp1Jt/e0a2XU8Q==",
+      "license": "MIT"
+    },
     "node_modules/lodash.defaults": {
       "version": "4.2.0",
       "dev": true,
diff --git a/package.json b/package.json
index b2307b52..13196fd1 100644
--- a/package.json
+++ b/package.json
@@ -58,6 +58,7 @@
     "@testing-library/jest-dom": "6.8.0",
     "@testing-library/react": "16.3.0",
     "@types/jest": "^29.5.14",
+    "@types/lodash-es": "^4.17.12",
     "@types/react": "19.1.8",
     "@types/react-dom": "19.1.6",
     "@typescript-eslint/eslint-plugin": "^8.36.0",
@@ -95,6 +96,7 @@
     "react-dom": "^16.11.0 || ^17 || ^18 || ~19.0.1 || ~19.1.2 || ^19.2.1"
   },
   "dependencies": {
-    "@auth0/auth0-spa-js": "^2.11.0"
+    "@auth0/auth0-spa-js": "^2.11.0",
+    "lodash-es": "^4.17.22"
   }
 }
diff --git a/src/reducer.tsx b/src/reducer.tsx
index a49e960e..829c6b5f 100644
--- a/src/reducer.tsx
+++ b/src/reducer.tsx
@@ -1,5 +1,6 @@
 import { User } from '@auth0/auth0-spa-js';
 import { AuthState } from './auth-state';
+import { isEqual } from 'lodash-es';
 
 type Action =
   | { type: 'LOGIN_POPUP_STARTED' }
@@ -35,7 +36,7 @@ export const reducer = <TUser extends User = User>(state: AuthState<TUser>, acti
       };
     case 'HANDLE_REDIRECT_COMPLETE':
     case 'GET_ACCESS_TOKEN_COMPLETE':
-      if (state.user === action.user) {
+      if (isEqual(state.user, action.user)) {
         return state;
       }
       return {