Add 'stop impersonating' link to user avatar dropdown when impersonating

ted · 21 أغسطس 2025، 6:22ص

لقد قمنا للتو بدمج ميزة تجريبية تتيح لك انتحال شخصية مستخدم دون الحاجة إلى تسجيل الخروج بعد ذلك.

github.com/discourse/discourse

DEV: Allow impersonation without session swapping

main ← feature/persistent-session-impersonation

opened 07:43AM - 11 Aug 25 UTC

Drenmi

+356 -11

### What is this feature? The current impersonation feature works by signing …you in as the user you are impersonating. This has the side effect of invalidating your own session and forcing you to log out and in again. In this experimental implementation you keep your existing session, but `DefaultCurrentUserProvider` returns the user being impersonated, allowing you to see the site from their perspective. ![impersonation](https://github.com/user-attachments/assets/61826378-62d2-427f-8967-63f8bb42d3b4) ### Security There are two immediate questions to ask here: **What if the application code path is compromised?** The new implementation uses the same code path as the old one (with `ImpersonateController#create` as an entry point), and (critically) is behind the same guardian check. **What if the database is compromised?** As an implementation detail, this has a new field `impersonated_user_id` on the `UserAuthToken`. This table already has a `user_id` associated with the session, so if the table is compromised, it is already a pre-existing one. So this implementation should have the exact same surface area and risk profile as the existing one.

إذا كنت ترغب في استخدام هذا، فقم بتمكين إعداد الموقع المخفي experimental_impersonation وأبلغ عن أي مشكلات هنا.

الموضوع		الردود	مرات العرض
Thoughts about impersonate user Community impersonate	88	2576	24 مارس 2023
The Impersonated user should be notified that they are being Impersonated Feature impersonate	21	2258	7 مايو 2019
Impersonate a user and returning to admin user Site Management how-to , impersonate , users	3	5608	5 نوفمبر 2024
Allow specific users to impersonate defined users Dev impersonate	9	904	5 مايو 2024
Log when a user impersonates another user Feature impersonate	4	922	6 نوفمبر 2014

Add 'stop impersonating' link to user avatar dropdown when impersonating

الموضوعات ذات الصلة