Logged out when impersonating user with password

[ivarsmednis]

Hi! Just installed package on Laravel Framework 11.44.2 with Jetstream. I can successfully impersonate users that have no password but for users with password i get logged out. For routes using

'auth:sanctum',
config('jetstream.auth_session'),
'verified',

would appreciate if someone could help. thanks!

[github-actions]

This issue is stale because it has been open for 30 days with no activity.

[dalbo]

I found when implementing this, that on the routes for entering and leaving impersonation, I had to disable the config('jetstream.auth_session') middleware. I think the default middleware for this is AuthenticateSession::class, and part of what it does is add the current user's password hash into the session. On each request it verifies that the hash in the session equals the hash coming from the db for the logged in user.

This obviously fails when you change the logged in user, which is exactly what the impersonation library does.

So I added this to our enter/leave impersonation routes
->withoutMiddleware([AuthenticateSession::class, JAuthenticateSession::class]);

where those classes are included as

use Illuminate\Session\Middleware\AuthenticateSession;
use Laravel\Jetstream\Http\Middleware\AuthenticateSession as JAuthenticateSession;

This is not using the UI provided by the package, but we have configured our own controller and UI to manage entering and leaving impersonation. I don't know what is/isn't possible using the standard UI.

[SupianIDz]

Hi @dalbo, thanks for the thorough investigation and clear explanation — this is extremely helpful.

Would you be willing to open a Pull Request for this change?
Handling the need to disable AuthenticateSession on impersonation enter/leave routes would be very valuable for the project and other Jetstream users.

Jetstream’s session behavior can be quite tricky, and your findings clarify the root cause really well.

Thanks again for taking the time to share this.

[dalbo]

I will see what I can do. We're still running on an older version, and we're not using the provided UI, so I haven't looked closely at the code for the package, or modified anything there so far.