{
  "id": 9371124,
  "title": "Read-only user impersonation in Rails",
  "url": "https://urgent.news/2026/09/23/read-only-user-impersonation-in-rails",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-23T16:33:05.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/edwardfancher/read-only-user-impersonation-in-rails-aeh"
  },
  "original_language": "en",
  "account": "Many support tools have a feature to \"log in as this customer.\" However, the existing gems did not solve the problem of impersonating customers with sensitive data. Delist My Data, a service that helps users delete their personal information from the web, needed a way to restrict administrators from performing sensitive actions while impersonating customers. The team wanted to inform customers about when administrators viewed their account information. They built this functionality and released it as a gem called ViewingAs. The existing gems have limitations, such as not refusing writes or keeping a log of actions taken during impersonation. ViewingAs addresses these issues by implementing two layers of protection. The first layer prevents non-GET/HEAD requests during an impersonation session. The second layer intercepts attempts to perform write actions and logs them at error level. A read-only setting is also provided, which can be disabled if needed. The gem includes a consent lambda that determines whether impersonation is allowed based on the customer's preferences. The security of the system is ensured by signing the cookie containing the impersonation information and re-validating it on every request. This prevents session expiration or withdrawal of consent from causing unintended writes by the impersonating user.",
  "summary": "Many support tools eventually grow a \"log in as this customer\" feature. Ours had a problem the usual gems don't solve. The people on the other side of the button are customers of a service containing sensitive user data. Delist My Data clients give us the history of their personal information that we will work to have taken down across the web. We want our admins to be restricted from ordering…",
  "key_points": [
    "ViewingAs gem restricts administrators from sensitive actions during impersonation",
    "Prevents non-GET/HEAD requests and logs write attempts at error level",
    "Consent lambda determines impersonation based on customer preferences"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}