# Add 'stop impersonating' link to user avatar dropdown when impersonating

**URL:** https://meta.discourse.org/t/add-stop-impersonating-link-to-user-avatar-dropdown-when-impersonating/13806
**Category:** Feature
**Tags:** completed, impersonate
**Created:** [3월 17, 2014, 4:35오후 UTC](https://meta.discourse.org/t/add-stop-impersonating-link-to-user-avatar-dropdown-when-impersonating/13806 "2014-03-17T16:35:33Z")
**Posts on this page:** 1
**Showing post:** 41

<div class="post-metadata">

### Author: ![ted](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ted/32/283882_2.png) [@ted](https://meta.discourse.org/u/ted)
#### Post date: [8월 21, 2025, 6:22오전 UTC](https://meta.discourse.org/t/add-stop-impersonating-link-to-user-avatar-dropdown-when-impersonating/13806/41 "2025-08-21T06:22:10Z")

</div>

방금 로그아웃하지 않고도 사용자를 사칭할 수 있는 실험적 기능을 병합했습니다.

> <https://github.com/discourse/discourse/pull/34213>
>
> \### What is this feature?
> 
> The current impersonation feature works by signing …you in as the user you are impersonating. This has the side effect of invalidating your own session and forcing you to log out and in again.
> 
> In this experimental implementation you keep your existing session, but \`DefaultCurrentUserProvider\` returns the user being impersonated, allowing you to see the site from their perspective.
> 
> !\[impersonation\](https://github.com/user-attachments/assets/61826378-62d2-427f-8967-63f8bb42d3b4)
> 
> \### Security
> 
> There are two immediate questions to ask here:
> 
> \*\*What if the application code path is compromised?\*\*
> 
> The new implementation uses the same code path as the old one (with \`ImpersonateController#create\` as an entry point), and (critically) is behind the same guardian check.
> 
> \*\*What if the database is compromised?\*\*
> 
> As an implementation detail, this has a new field \`impersonated\_user\_id\` on the \`UserAuthToken\`. This table already has a \`user\_id\` associated with the session, so if the table is compromised, it is already a pre-existing one.
> 
> So this implementation should have the exact same surface area and risk profile as the existing one.

사용하려면 숨겨진 사이트 설정인 `experimental_impersonation`을 활성화하고, 문제가 발생하면 여기에 보고해 주세요. 🙏

---

_[View the full topic](https://meta.discourse.org/t/add-stop-impersonating-link-to-user-avatar-dropdown-when-impersonating/13806)._