Impersonation in Laravel with the Mirror Package

Mirror is an elegant user impersonation package for Laravel that lets administrators log in as other users to troubleshoot issues, provide support, and test user experiences. Secure user impersonation is paramount to production applications, and Mirror provides cryptographic verification to prevent session tampering.

It works by adding an Impersonatable trait to your User model and implementing two methods. These methods define which role can impersonate other roles, and which roles are allowed to be impersonated by those with impersonation abilities:

use Illuminate\Foundation\Auth\User as Authenticatable;
use Mirror\Concerns\Impersonatable;
 
class User extends Authenticatable
{
    use Impersonatable;
 
    public function canImpersonate(): bool
    {
        return $this->hasRole('admin');
    }
 
    public function canBeImpersonated(): bool
    {
        return ! $this->hasRole('super-admin');
    }
}

From there, you can start impersonating and stop impersonating using the package's Mirror facade:

use Mirror\Facades\Mirror;
 
// Start impersonating a user
Mirror::start($user);
redirect()->route('dashboard');
 
// Stop impersonating
Mirror::stop();
redirect()->route('admin.users.index');

This package also includes methods for checking the state of impersonation, events, Blade directives, and more:

@impersonating
    <div class="alert">
        You're impersonating {{ auth()->user()->name }}.
        <a href="{{ route('impersonation.leave') }}">Exit</a>
    </div>
@endimpersonating
 
{{-- Check specific guard --}}
@impersonating('admin')
    <div>Impersonating via admin guard</div>
@endimpersonating

#Main Features

• HMAC-SHA256 session integrity to prevent tampering
• Configurable TTL expiration
• Middleware for access control and TTL enforcement
• Multi-guard support
• Flexible URL redirection
• Lifecycle events for audit logging

To start using this package in your Laravel project, you can install it via Composer and publish the package's configuration options:

composer require franbarbalopez/mirror
 
php artisan vendor:publish --tag=mirror

🧑‍💻 You can find the source code and documentation on GitHub: franbarbalopez/mirror