From a custom module, I would like to impersonate and start any user session in the browser. This session will be based on a user query result got from a web controller.

Something in a way like when we click on the impersonate link from the CP when logged in as Admin. But here, no admin session would be active before trying to log in as.

To specify the security context of this request: the query to get the user will be secure, it will be got from a server response based on the data returned by a third party OAuth-like service.

How is it possible to start any user session programmatically?

1 Answer 1


Technically, there is no real "impersonation" in Craft. All the "impersonate" action in the CP does, is to log in the currently logged-in user as a different user; albeit with some permission/security checks, and some logic to handle cases where the impersonated user hasn't been activated yet.

With that in mind, all you really need to do is to log in the requested user by their ID:


It can be worth looking at the core impersonation action though, and copy whatever extra logic your application needs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.