# Log when a user impersonates another user

**URL:** https://meta.discourse.org/t/log-when-a-user-impersonates-another-user/21840
**Category:** Feature
**Tags:** impersonate
**Created:** [November 5, 2014, 8:00am UTC](https://meta.discourse.org/t/log-when-a-user-impersonates-another-user/21840 "2014-11-05T08:00:46Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![funvill](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/funvill/32/103428_2.png) [@funvill](https://meta.discourse.org/u/funvill)
#### Post date: [November 5, 2014, 8:00am UTC](https://meta.discourse.org/t/log-when-a-user-impersonates-another-user/21840/1 "2014-11-05T08:00:46Z")

</div>

Discourse has this great log of all the actions that the admins do (Staff actions).  
_/{discorse URL}/admin/logs/staff\_action\_logs_

One thing it does not record is when an admin “_impersonates_” another user. This could be problematic as I want to have moderators and admins to have this ability but I want a log of this action to know when it is happening. To help reduce admin abuse.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 6, 2014, 2:39am UTC](https://meta.discourse.org/t/log-when-a-user-impersonates-another-user/21840/2 "2014-11-06T02:39:53Z")

</div>

Impersonation is limited to “developer” accounts anyway, only the account that installed Discourse can use this feature. A regular admin appointed after install, cannot.

That is my understanding can you confirm @sam?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 6, 2014, 3:41am UTC](https://meta.discourse.org/t/log-when-a-user-impersonates-another-user/21840/3 "2014-11-06T03:41:29Z")

</div>

Admins can impersonate anyone except for other admins  
Developers can impersonate anyone  
Moderators can not impersonate

We should log this regardless

> <https://github.com/discourse/discourse/blob/b09ad870980b4ec29a0f3497680eda7778c4a11e/lib/guardian.rb#L126-L139>

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [November 6, 2014, 9:59am UTC](https://meta.discourse.org/t/log-when-a-user-impersonates-another-user/21840/4 "2014-11-06T09:59:51Z")

</div>

> [@sam](#):
>
> We should log this regardless

And we do now 🐩

[https://github.com/discourse/discourse/commit/bb2d53819431ba92d45b20950854dfc8131c858c](https://github.com/discourse/discourse/commit/bb2d53819431ba92d45b20950854dfc8131c858c)

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [November 6, 2014, 9:59am UTC](https://meta.discourse.org/t/log-when-a-user-impersonates-another-user/21840/5 "2014-11-06T09:59:54Z")

</div>