--- title: Impersonation is not a free pass past authorization description: Support impersonation ('login as user') is a common feature that silently breaks authorization when the admin session simply becomes the target user, skipping... canonical: https://daily.dev/posts/impersonation-is-not-a-free-pass-past-authorization-8sost5wpd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Impersonation is not a free pass past authorization | daily.dev og:description: Support impersonation ('login as user') is a common feature that silently breaks authorization when the admin session simply becomes the target user, skipping... og:url: https://daily.dev/posts/impersonation-is-not-a-free-pass-past-authorization-8sost5wpd og:image: https://api.daily.dev/og/posts/8SosT5WPd.png og:image:alt: Impersonation is not a free pass past authorization og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Impersonation is not a free pass past authorization **[Auth By Example](https://daily.dev/sources/7eadcwhmohx0bchehapmt)** · [@authbyexample](https://daily.dev/authbyexample) · 2 min read · 0 upvotes · 0 comments ## Summary Support impersonation ('login as user') is a common feature that silently breaks authorization when the admin session simply becomes the target user, skipping checks for both parties. The piece lays out a policy: restrict who can impersonate and for how long, enforce the target's own permissions during impersonation rather than retaining admin superpowers, audit both the impersonator and the assumed identity, bound sessions with short TTLs and sensitive-action restrictions, and block chained impersonation. A quick test is suggested: as a support account, impersonate a read-only user and attempt a write; if it succeeds, the impersonation is just a UI costume rather than real authorization enforcement. The author notes a connection to Permit.io as a policy engine that can handle both the impersonation and assumed-user authorization decisions. ## Content "Login as user" / support impersonation is useful for debugging. It is also a classic place where authorization quietly disappears: the admin session becomes the target user, and every subsequent request skips the checks that would have applied to either party. Treat impersonation as a new authorization context, not a shortcut: 1. Decide who may start an impersonation session (usually a narrow support role), against which tenants, and for how long. Logging in as anyone in the company is not a product feature — it is a privilege that needs its own policy. 2. While impersonating, authorize actions as the target user for normal product permissions. Do not keep the admin's superpowers unless the tool is explicitly an admin override (and then label it as such). 3. Audit both actors: who started the session, which user was assumed, and every privileged action taken. Without that trail, "login as" is unaccountable access. 4. Bound the session: short TTL, explicit end, no refresh that outlives the support ticket, and no ability to change password / MFA / billing while assumed unless that is a documented exception. 5. Block nested or chained impersonation. An assumed user should not be able to assume someone else. Quick check: as a support account, impersonate a read-only user and try a write the target cannot perform. If it succeeds because you are still "admin underneath," your impersonation path is not applying the target's authorization — it is just a UI costume. If you are externalizing those checks, the same policy engine should decide both "may impersonate X" and "assumed X may do Y" — (full disclosure, I work with Permit.io) https://www.permit.io/?utm_source=dailydev&utm_medium=social&utm_campaign=impersonation-still-needs-authorization&utm_content=authbyexample — but the design rule holds with any stack: impersonation changes the subject; it does not erase authorization. ## Similar posts on daily.dev - [Always-on privileged access is pervasive — and fraught with risks](https://daily.dev/posts/always-on-privileged-access-is-pervasive-and-fraught-with-risks-pvlw6ry4b) · CSO Online · 0 upvotes · 0 comments - [Medium](https://daily.dev/posts/medium-1a8fbfqta) · Medium · 1 upvotes · 0 comments - [AI Agents Are Privileged Users; Who Is Auditing Their Access?](https://daily.dev/posts/ai-agents-are-privileged-users-who-is-auditing-their-access--gprca2dhv) · Dark Reading · 0 upvotes · 0 comments - [AI Agents Are Not Users: Building an AI Agent Identity Model](https://daily.dev/posts/ai-agents-are-not-users-building-an-ai-agent-identity-model-0gmsbkuop) · Auth0 · 1 upvotes · 0 comments - [Beyond Prompt Injection: The Non-Human Authorization Gap in Enterprise AI](https://daily.dev/posts/beyond-prompt-injection-the-non-human-authorization-gap-in-enterprise-ai-kyg9zgkps) · DEV · 2 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#logging](https://daily.dev/tags/logging), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/impersonation-is-not-a-free-pass-past-authorization-8sost5wpd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/impersonation-is-not-a-free-pass-past-authorization-8sost5wpd","headline":"Impersonation is not a free pass past authorization","text":"Support impersonation ('login as user') is a common feature that silently breaks authorization when the admin session simply becomes the target user, skipping checks for both parties. The piece lays out a policy: restrict who can impersonate and for how long, enforce the target's own permissions during impersonation rather than retaining admin superpowers, audit both the impersonator and the assumed identity, bound sessions with short TTLs and sensitive-action restrictions, and block chained impersonation. A quick test is suggested: as a support account, impersonate a read-only user and attempt a write; if it succeeds, the impersonation is just a UI costume rather than real authorization enforcement. The author notes a connection to Permit.io as a policy engine that can handle both the impersonation and assumed-user authorization decisions.","url":"https://daily.dev/posts/impersonation-is-not-a-free-pass-past-authorization-8sost5wpd","datePublished":"2026-09-30T08:15:58.023Z","dateModified":"2026-09-30T08:16:15.489Z","author":{"@type":"Person","name":"Auth By Example","url":"https://daily.dev/authbyexample","image":"https://media.daily.dev/image/upload/s--Fgz7IgGQ--/f_auto/v1789653205/avatars/avatar_7EADCwHmOHX0bChEhAPmt?_a=BAMAMicg0","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":30}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/7eadcwhmohx0bchehapmt","name":"Auth By Example"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Auth By Example","item":"https://daily.dev/sources/7eadcwhmohx0bchehapmt"},{"@type":"ListItem","position":3,"name":"Impersonation is not a free pass past authorization"}]} ```