User Impersonation
A security mechanism in web applications that allows administrators or support staff to temporarily perform actions as a target user, used for troubleshooting or user support. Implementation depends on the underlying session management mechanism, either cookie-based or Bearer Token-based.
Timeline (last 90 days)
The user impersonation approach recommended by most web frameworks is to swap cookies, i.e., replacing the current session cookie with the target user's session cookie
Some authentication SDKs return a completely new token representing the impersonated user's identity in impersonation scenarios, while others return a token with special claims
In the cookie-swap approach, the save-and-restore-original-credentials process upon exiting impersonation itself constitutes an attack surface that may lead to session confusion or privilege escalation.
Implementing user impersonation under a Bearer Token architecture should be designed around the token itself rather than applying cookie-swap thinking, and solutions that can embed real-operator claims should be preferred.
All Facts (4)
The user impersonation approach recommended by most web frameworks is to swap cookies, i.e., replacing the current session cookie with the target user's session cookie
50%UnverifiedSome authentication SDKs return a completely new token representing the impersonated user's identity in impersonation scenarios, while others return a token with special claims
50%UnverifiedIn the cookie-swap approach, the save-and-restore-original-credentials process upon exiting impersonation itself constitutes an attack surface that may lead to session confusion or privilege escalation.
50%UnverifiedImplementing user impersonation under a Bearer Token architecture should be designed around the token itself rather than applying cookie-swap thinking, and solutions that can embed real-operator claims should be preferred.
50%