Weave Code
Laravel Impersonate Laravel Package
octopyid/laravel-impersonate
Laravel Impersonate lets admins log in as any user without passwords, then switch back safely. It includes middleware, events, and multi-guard support for secure, flexible user impersonation in Laravel apps.
Login as a different user quickly for Laravel
Frequently asked questions about Laravel Impersonate
- How do I install octopyid/laravel-impersonate in a Laravel app?
- Install it with composer require octopyid/laravel-impersonate, then add the HasImpersonation trait to your authenticatable user model and publish the package config and assets using the vendor:publish command documented in the README. The package renders a Blade/JS widget and exposes /_impersonate/users and /_impersonate/login endpoints. For v5, confirm your app meets PHP 8.2+ and Laravel 12.x-13.x before starting.
- Does laravel-impersonate support Laravel 10 or 11?
- No for v5.0.0: it requires PHP 8.2+ and Laravel 12.x-13.x, so Laravel 10 or 11 applications cannot upgrade without first upgrading Laravel. v4.x may run on older stacks, but it carries the HIGH information disclosure issue fixed in v5. Treat the version floor as a schedule-level constraint, not a routine bump.
- Is v4.x of laravel-impersonate safe to use in production?
- v4.x has a HIGH information disclosure finding: the v5 release fixes user enumeration through the package endpoints. Unless the maintainer provides a backported patch, v4.x should be treated as having a live security finding. Triage it independently of whether you plan to adopt v5.
- How do I limit which users can be impersonated?
- Implement scopeImpersonatable() or a #[Scope] on your user model to constrain the query used by the /_impersonate/users endpoint. This is a required v5 code change, not an optional optimization: v5 removed in-memory filtering, so without a scope the candidate list is whatever the query returns, which on a normal users table is everyone. Add a test that asserts a non-admin or out-of-scope user cannot appear in or be targeted from that list.
- What are the breaking changes in laravel-impersonate v5.0.0?
- Expect environment renames such as IMPERSONATE_ENABLED to IMPERSONATE_UI_ENABLED, the enabled config moving under the interface key, and a mandatory scopeImpersonatable() implementation for candidate filtering. The package also raises the floor to PHP 8.2+ and Laravel 12.x-13.x and returns 403 from both /_impersonate endpoints when no valid session is present. Most changes are mechanical, but the scoping change is security-relevant and needs review and tests.
- How does laravel-impersonate log an admin in as another user?
- It adds a HasImpersonation trait to your user model, exposes a search endpoint at /_impersonate/users and a login endpoint at /_impersonate/login, and renders a Blade/JS widget into the host layout. An authenticated admin selects a target user, and the package authenticates that user through the session guard without a password. The package also provides a way to switch back safely, plus middleware and events.
- Does laravel-impersonate provide audit logging for impersonation?
- The available v5 notes do not document an audit log, a who-impersonated-whom-when trail, or session invalidation behavior when impersonation ends. The package does ship events, so integrating teams can subscribe and write their own audit records. Because impersonation can assume any user's identity, treat audit logging and session handling as application responsibilities unless the README states otherwise.
- Does laravel-impersonate support multiple guards?
- Yes, multi-guard support is part of the package's stated feature set. It is designed around Laravel's session-based guards, so configure the guard or guards you need in the published package config. If you use non-session or API-token guards, verify behavior in your own tests before relying on it.
- Do I need Node or a build pipeline to customize the impersonation UI?
- No for v5.0.0. The release drops jQuery, Select2, Webpack, package.json, and .nvmrc, so the package no longer requires a Node toolchain. Customization moves from SCSS variable overrides to overriding the published Vanilla CSS and JS. That reduces build and supply-chain surface but gives you a different theming workflow.
- Is loginAs($user) subject to the same authorization checks as the HTTP endpoints?
- The v5 evaluation flags this as unresolved: loginAs($user) is a fluent API where the impersonator is inferred, and the available release notes do not state whether it enforces the same guards as the /_impersonate routes. Until you confirm it in the source or with the maintainer, treat direct loginAs calls as privileged code intended for console or seed contexts. Wrap them with your own authorization checks and audit logging.
Weaver
How can I help you explore Laravel packages today?