Weave Code
Switch User Stateless Bundle Laravel Package
lafourchette/switch-user-stateless-bundle
A Symfony bundle for stateless user switching. Impersonate or switch between users without relying on session state, making it useful for debugging, testing, and admin tooling that integrates with Symfony's security system.
Bundle to use impersonating on Symfony API
Frequently asked questions about Switch User Stateless Bundle
- Is lafourchette/switch-user-stateless-bundle a Laravel package?
- No. It is a Symfony bundle that is structurally coupled to the Symfony Security component. Its whole purpose is to replace Symfony's session-bound SwitchUserListener with a stateless variant driven by request headers and firewall configuration. Laravel has no SwitchUserListener, no security.yaml, and no firewall contract for it to hook into.
- Can I install lafourchette/switch-user-stateless-bundle in a Laravel application?
- Composer may technically resolve it, but it will do nothing useful in Laravel. The bundle registers a Symfony kernel event listener and expects security.firewalls configuration plus a ROLE_ALLOWED_TO_SWITCH check that Laravel never invokes. It would be dead weight with no integration surface.
- What does this Symfony bundle actually do?
- It provides stateless user impersonation for Symfony APIs. Instead of storing the impersonated user in the session, it resolves the target user from a request header and validates the switch against the firewall's ROLE_ALLOWED_TO_SWITCH configuration. That makes it useful for API debugging and admin tooling in Symfony, not Laravel.
- What Laravel package should I use for user impersonation instead?
- Use lab404/laravel-impersonate if session-based staff impersonation is acceptable; it is maintained, widely adopted, and has a documented request-level variant. For stateless flows, write a small middleware or use a short-TTL Sanctum token carrying an impersonator_id claim. Gate the capability with a policy or Gate check rather than a hardcoded role string.
- How do I implement stateless impersonation in Laravel?
- Build a middleware that reads a signed impersonation header, verifies the caller holds a designated permission via Gate or a policy, resolves the target user, and calls Auth::onceUsingId() or Auth::setUser() for that request only. Protect the header with Laravel's signed middleware or a short-lived Sanctum token that carries an impersonator_id claim. This is roughly 200 lines and keeps the privileged check inside your own audited code.
- Does lafourchette/switch-user-stateless-bundle support Laravel 10 or Laravel 11?
- No. It has no Laravel version support because it is not a Laravel package at all. It is a Symfony 2/3-era bundle and likely pins PHP 5.6–7.x constraints and an end-of-life Symfony range. Do not expect it to work with modern Laravel or PHP 8.x.
- Is lafourchette/switch-user-stateless-bundle still maintained?
- Treat it as abandoned. It has zero dependents, blank star data, and comes from lafourchette, which has since rebranded to TheFork. It appears to be a dormant utility published for internal use rather than a supported distribution.
- What are the security risks of using an abandoned impersonation bundle?
- Impersonation is a privileged capability, and in this bundle the authorization check lives inside unmaintained code. You would own any glue code written against that private API surface forever, with no upstream patches. Impersonating a customer is also a GDPR-relevant access event in most jurisdictions, so audit logging and consent obligations matter.
- Can I use Symfony's switch_user firewall configuration in Laravel?
- No. Laravel has no security.yaml, no firewalls, and no ROLE_ALLOWED_TO_SWITCH equivalent. The Laravel analogue is the Auth guard and Auth::login() pipeline, typically combined with middleware. Trying to port the firewall contract would mean reimplementing the bundle rather than integrating it.
- How should I test impersonation in a Laravel application?
- Write feature tests that assert a valid signed impersonation header authenticates the target user for that request only, and that requests without the required permission are rejected. Use actingAs or Sanctum::actingAs to set up the impersonator, and assert the audit log records who impersonated whom. Also test that the impersonation does not persist into subsequent requests.
Weaver
How can I help you explore Laravel packages today?