I'm using JWTs for authentication. It would be good as a means of double checking the user's experience if an admin user could log in as a regular user.

One way I thought to implement this could be to test the hash of the login password against a master password hash when authenticating in addition to the user's password hash. Obviously, since you're entering this password into the browser, it's far less secure than the JWT secret key that you store on your server for signing. So, I'm guessing that this master password might want to be only enabled for a small set of users and only enabled for certain periods when this testing need be done.

Are there any standard ways of allowing an admin to log in as a regular user to view things from their perspective within a JWT auth setup? I can't seem to find any googling for them.


A possible way to allow a privileged user to see what would see a normal user is to implement the ability to (temporarily) drop priviledges in the security layer of an application.

Another way is to let the admin work by default at a regular security level and specifically require a privileged level for administrative tasks. The choice between those way depends on whether the admin mainly process administrative or normal level tasks.

The nice point with both those ways is that an admin will only sees its own data whatever the level, which could matter for sensitive application (medical data for example).

If data sensitivity is not too high, another (maybe more common) way is to allow an admin to impersonate another user. Here the nice point is that the admin will really see the same screen (including same data) as the user, which can help for user assistance.

But whatever the way, it must be explicitely implemented at the application level, specifically in the security layer.

| improve this answer | |
  • "allow an admin to impersonate another user" - I'm looking to do this and to check if the way I suggest is a good one or if there is a better more standard way of doing this. – teaspoon Feb 10 at 16:20

Many applications that implement this kind of feature calls them masquerade or impersonate as another user feature.

Check with the web framework that you used to implement the server if they have a plugin that implements this.

The authentication mechanism you're using (JWT) is irrelevant.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.