A Laravel package that allows administrators to authenticate as other users for debugging and support.
Laravel Impersonate is a Laravel package that allows administrators to temporarily log in as other users within the application. It solves the problem of debugging user-specific issues, testing features from a user's perspective, or providing support without compromising security by sharing passwords.
Laravel developers building applications where administrators need to simulate user experiences, such as in customer support portals, SaaS platforms, or complex multi-user systems.
Developers choose Laravel Impersonate for its simplicity, security features like authorization controls and middleware protection, and seamless integration with Laravel's ecosystem, including Blade directives and event hooks.
Laravel Impersonate is a plugin that allows you to authenticate as your users.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Adding the Impersonate trait to the User model enables quick impersonation setup, as shown in the one-click authentication example without complex configuration.
Methods like canImpersonate() and canBeImpersonated() allow fine-grained control over who can impersonate and be impersonated, enhancing security by defaulting to custom logic instead of open access.
Built-in directives such as @canImpersonate and @impersonating simplify conditional UI rendering for impersonation buttons and status indicators, integrating seamlessly with Laravel's templating engine.
TakeImpersonation and LeaveImpersonation events fire during sessions, enabling custom logic like logging or notifications without modifying core package code, as highlighted in the events section.
The package is built for Laravel's web middleware and session authentication, making it unsuitable for stateless API applications or those using token-based auth without significant workarounds.
Out of the box, all users can impersonate and be impersonated, requiring developers to manually implement authorization methods to prevent potential security vulnerabilities if overlooked.
While supported, using impersonation with multiple authentication guards requires additional setup in routes and guards, which can be error-prone and less documented compared to single-guard usage.