Impersonator login

There is a lesson about it here in Laracasts:

https://laracasts.com/series/how-do-i/episodes/17

This lesson also has a github repo:

https://github.com/laracasts/Impersonate-Users-in-Laravel

===

EDIT: check the tests in the repo, they give a good clue on Jeffrey's approach to this

This is what I do;

ImpersonateController.php

<?php

namespace App\Http\Controllers\Admin;

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use App\User;
use Session;

class ImpersonateController extends Controller
{
    public function store(Request $request)
    {

        $user = User::find($request->who);

        session()->put('impersonate', $user->id);

        Session::flash('success', "You are now impersonating {$user->name}");

        return redirect(route('home'));

    }

    public function destroy()
    {
        session()->forget('impersonate');

        return redirect(route('home'));
    }
}

Middleware

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Support\Facades\Auth;

class Impersonate
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if (session()->has('impersonate')) {
            Auth::onceUsingID(session('impersonate'));
        }

        return $next($request);
    }
}

register the route middleware

    protected $middlewareGroups = [
        'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            \App\Http\Middleware\AuthenticateSessionWithImpersonation::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            \App\Http\Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
//add impersonation
            \App\Http\Middleware\Impersonate::class,
        ],

Show a button in the navbar

@if(session()->has('impersonate'))
         <li class="ml-4">
            <a class="btn btn-danger" href="#" onclick="event.preventDefault();document.getElementById('impersonate').submit();">
                <i class="fas fa-user-ninja mr-2"></i>Stop Impersonating
            </a>
        </li>

        <form method="POST" action="{{ route('admin.impersonate.destroy') }}" id="impersonate"  >
            {{ csrf_field() }}
            {{ method_field('DELETE') }}
        </form>

@endif

and then a couple of additional routes

inside the admin routes

    Route::post('admin/impersonate', 'Admin\ImpersonateController@store')->name('admin.impersonate.store');

The destroy method must be callable by the user you are impersonating so this goes inside authenticated routes

    Route::delete('admin/impersonate', 'Admin\ImpersonateController@destroy')->name('admin.impersonate.destroy');

edit: Sorry, missed a check from the navbar element. Added it now.

@rodrigo.pedra thanks! I don't know how I missed this. I shall watch it to get get the full detail.

I would store the original user in the session.

Its still available right before using the Auth:onceUsingId because your session cookie is still pointing to the original user. You could use it there, but I guess you want it when the actions are actually being performed.

yeah that sounds like a good plan. Thanks again!