devise_masquerade: user_masquerade? not working as expected (and it goes terribly wrong)

I had a case in production where a user was logged as an other (admin) account.

After investigation in version 1.3.2, the helper user_masquerade? returns true for ALL logged users when masquerade is used

That means :

if user_masquerade? 
  = link_to "Reverse masquerade", back_masquerade_path(current_user)

shows back link for ALL logged users

The most funny part ? If any user clicks this link he become logged as the user who used masquerade (in our case an admin user…)

About this issue

Original URL
State: closed
Created 3 years ago
Reactions: 2
Comments: 33 (11 by maintainers)

Most upvoted comments

Since v1.3.1 (https://github.com/oivoodoo/devise_masquerade/commit/cf0e1529757f2eea1f56559a94f4f860ed69f916) and up to at least v1.3.8, in order for user_masquerade? to work, you need caching turned on.

Without caching turned on, this line in the #{name}_masquerades? method will fail… https://github.com/oivoodoo/devise_masquerade/blob/827c64b4a0881b339f32d157da595826ff61b746/lib/devise_masquerade/controllers/helpers.rb#L46

…and you’ll get false every time.

With caching turned on, user_masquerade? works as expected.

In Rails 6, to turn on caching in development mode, you run rails dev:cache. This creates a file named tmp/caching-dev.txt and is used by development.rb to use a :memory_store cache (by default). Running rails dev:cache again will turn off caching by removing the tmp/caching-dev.txt file. Restart your Rails server for changes to take effect.

https://guides.rubyonrails.org/caching_with_rails.html#caching-in-development

At runtime, you can see if your cache is on using this…

Rails.application.config.action_controller.perform_caching # should return true

In the Troubleshooting section of the README it does mention how to turn caching on in development, but it doesn’t mention that not turning it will stop user_masquerade? from working.

dbastin on Aug 2, 2021

As we had problems even on production because the user switch logged out the user in some cases or some time (probably at the third user switch) we chose another solution: Gem pretender is really easy to implement and safe to use and very popular.

sreuterle on May 18, 2022

The behaviour might have stopped manifesting itself after running rails dev:cache. Not 100% sure, though.

yrashk on Jun 22, 2021

user_masquerade? is still returning false for me on v 1.3.6 unfortunately

mkenny on Mar 30, 2021