Custom module controller: how to impersonate any user and start its session

Question

From a custom module, I would like to impersonate and start any user session in the browser. This session will be based on a user query result got from a web controller.

Something in a way like when we click on the impersonate link from the CP when logged in as Admin. But here, no admin session would be active before trying to log in as.

To specify the security context of this request: the query to get the user will be secure, it will be got from a server response based on the data returned by a third party OAuth-like service.

How is it possible to start any user session programmatically?

Answer 1

Technically, there is no real "impersonation" in Craft. All the "impersonate" action in the CP does, is to log in the currently logged-in user as a different user; albeit with some permission/security checks, and some logic to handle cases where the impersonated user hasn't been activated yet.

With that in mind, all you really need to do is to log in the requested user by their ID:

\Craft::$app->getUser()->loginByUserId(123);

It can be worth looking at the core impersonation action though, and copy whatever extra logic your application needs.