Read-only user impersonation in Rails

Many support tools have a feature to "log in as this customer." However, the existing gems did not solve the problem of impersonating customers with sensitive data. Delist My Data, a service that helps users delete their personal information from the web, needed a way to restrict administrators from performing sensitive actions while impersonating customers.

The team wanted to inform customers about when administrators viewed their account information. They built this functionality and released it as a gem called ViewingAs. The existing gems have limitations, such as not refusing writes or keeping a log of actions taken during impersonation. ViewingAs addresses these issues by implementing two layers of protection.

The first layer prevents non-GET/HEAD requests during an impersonation session. The second layer intercepts attempts to perform write actions and logs them at error level. A read-only setting is also provided, which can be disabled if needed. The gem includes a consent lambda that determines whether impersonation is allowed based on the customer's preferences.

The security of the system is ensured by signing the cookie containing the impersonation information and re-validating it on every request. This prevents session expiration or withdrawal of consent from causing unintended writes by the impersonating user.