Laravel Impersonate

Laravel Impersonate makes it easy to authenticate as your users. Add a single trait to your User model and you can log in as any user with one method call, then leave impersonation to return to your original account.

The package ships with a built-in controller and route macro, configurable authorization rules, middleware to protect routes during impersonation, and events you can hook into. It supports Laravel 6.x through 13.x on PHP 7.2+ and 8.0+.

What You Get

• An Impersonate trait that adds impersonate() and leaveImpersonation() to your User model
• A built-in controller and Route::impersonate() macro for turnkey routes
• Authorization hooks (canImpersonate() / canBeImpersonated()) to control who may impersonate whom
• Middleware to allow or block routes while impersonating
• Events fired on taking and leaving impersonation, plus Blade directives

Common Use Cases

• Support staff reproducing a bug by logging in as the affected user
• Admins verifying role- and permission-based views for specific accounts
• QA testing user-specific flows without sharing credentials
• Debugging account-scoped data issues in production-like conditions

Under The Hood

Architecture

The package centers on the Impersonate model trait and an ImpersonateManager service registered by ImpersonateServiceProvider. When impersonation starts, the manager swaps the authenticated user on the guard and stores the original user’s id (and guard) in the session; leaving impersonation restores it. A dedicated SessionGuard/guard layer, ProtectFromImpersonation middleware, and TakeImpersonation/LeaveImpersonation events round out the flow, with an optional built-in controller wired via the Route::impersonate() macro.

Tech Stack

Pure PHP targeting Laravel 6.x through 13.x on PHP 7.2+/8.0+. It integrates with Laravel’s Auth guards, session, routing, middleware, events, and Blade, and ships config and migration stubs. Tests run under PHPUnit.

Code Quality

The src/ tree is cleanly separated into Controllers, Events, Exceptions, Guard, Middleware, Models, and Services. A tests/ directory with phpunit.xml provides coverage, and the project historically ran Travis CI and Scrutinizer for quality scoring. A maintained changelog and broad framework version matrix indicate careful long-term maintenance.

API Design

The developer experience is intentionally minimal: add one trait, call impersonate($user), and optionally register one route macro. Authorization is expressed through simple overridable methods on the model, and the README documents advanced strategies, middleware, events, and Blade usage. The main caveat is remembering to guard impersonation routes and authorization to avoid privilege escalation.