django-impersonate

What it is and what it does

django-impersonate is a Django application that enables superusers to temporarily log in as other non-superuser accounts without needing their passwords. This is useful for debugging user-specific issues, testing permission systems, and providing support. The package injects an `is_impersonate` flag and an `impersonator` reference into the request object so your code can detect and audit when impersonation is active. It provides URL endpoints to start impersonation, stop it, list available users, and search for users to impersonate.

The package has no runtime dependencies beyond Django itself and relies on Django's built-in session framework. It includes middleware that integrates with Django's authentication system and provides signals you can hook into for audit logging. Configuration is optional—you can restrict which users can impersonate others and which users can be impersonated by defining custom allow/queryset functions.

Use it for:

• Debug a specific user's issue by impersonating their account and reproducing the problem in their context
• Test permission and access control logic by switching to accounts with different roles
• Provide customer support by temporarily viewing the application as a customer sees it
• Audit user actions by logging impersonation sessions via the provided signals
• Verify that certain features are correctly restricted to specific user types

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Allows Django superusers to temporarily assume the identity of other user accounts for testing and support purposes, with the original user remaining traceable.

Yes, with conditions. The package is stable, permissively licensed, and widely used. However, install friction is high (source distribution only), and maintenance is aging (496 days since last release). Install it if you need user impersonation in a Django admin context and can accept slower update cycles; avoid it if you require frequent security patches or active upstream support.

Install

django-impersonate on PyPI

pip install django-impersonate

uv add django-impersonate

poetry add django-impersonate

Installing django-impersonate

Before you install

High install friction due to source distribution only. Maintenance status is aging—last release was 496 days ago. The package is stable and widely used (top 15000 on PyPI), but slow update cadence may indicate limited active development.

License in practice

BSD License (permissive). You may use, modify, and distribute this package freely in commercial and private projects, with minimal restrictions.

Quickstart

pip install django-impersonate

# In settings.py:
INSTALLED_APPS = [
    ...
    'impersonate',
]

MIDDLEWARE = [
    ...
    'impersonate.middleware.ImpersonateMiddleware',
]

# In urls.py:
urlpatterns = [
    path('impersonate/', include('impersonate.urls')),
]

# Then visit /impersonate/<user-id>/ to start impersonation

Requires Django's session framework (django.contrib.sessions) to be enabled. ImpersonateMiddleware must be placed after django.contrib.auth middleware.

Verify before relying

• Whether the XSS vulnerability mentioned for versions 1.9.3 and below has been fully resolved in 1.9.5
• Current maintenance status and whether the 496-day gap since last release indicates active or dormant development

Package facts

Evidence: django_impersonate-1.9.5.tar.gz

Tags

More Dynamic Content packages