<p>Technically, there is no real &quot;impersonation&quot; in Craft. All the &quot;impersonate&quot; action in the CP does, is to log in the currently logged-in user as a different user; albeit with some permission/security checks, and some logic to handle cases where the impersonated user hasn't been activated yet.</p>
<p>With that in mind, all you really need to do is to log in the requested user by their ID:</p>
<pre class="lang-php prettyprint-override"><code>\Craft::$app-&gt;getUser()-&gt;loginByUserId(123);
</code></pre>
<p>It can be worth looking at <a href="https://github.com/craftcms/cms/blob/ea597a0fe33ddd579836b6238626a638dc1f194f/src/controllers/UsersController.php#L255" rel="nofollow noreferrer">the core impersonation action</a> though, and copy whatever extra logic your application needs.</p>

CC BY-SA 4.0
2023-04-29T08:50:57.290Z
2023-04-29T08:50:57.290Z
Mats Mikkel Rummelhoff
<p>From a custom module, I would like to impersonate and start any user session in the browser. This session will be based on a user query result got from a web controller.</p>
<p>Something in a way like when we click on the impersonate link from the CP when logged in as Admin. But here, no admin session would be active before trying to log in as.</p>
<p>To specify the security context of this request: the query to get the user will be secure, it will be got from a server response based on the data returned by a third party OAuth-like service.</p>
<p>How is it possible to start any user session programmatically?</p>

<users><modules><session><security><custom>
Custom module controller: how to impersonate any user and start its session
# Custom module controller: how to impersonate any user and start its session

(Asked by: username_0 on 2023-04-28)

From a custom module, I would like to impersonate and start any user session in the browser. This session will be based on a user query result got from a web controller.

Something in a way like when we click on the impersonate link from the CP when logged in as Admin. But here, no admin session would be active before trying to log in as.

To specify the security context of this request: the query to get the user will be secure, it will be got from a server response based on the data returned by a third party OAuth-like service.

How is it possible to start any user session programmatically?

**Tags:** users, modules, session, security, custom

---

## 1 answers

### Answer by username_1 on 2023-04-29. Score: 2 | Accepted answer

Technically, there is no real "impersonation" in Craft. All the "impersonate" action in the CP does, is to log in the currently logged-in user as a different user; albeit with some permission/security checks, and some logic to handle cases where the impersonated user hasn't been activated yet.
With that in mind, all you really need to do is to log in the requested user by their ID:
\Craft::$app->getUser()->loginByUserId(123);

It can be worth looking at the core impersonation action though, and copy whatever extra logic your application needs.


---

