title: Auth0 impersonation deprecated.. What should I use instead?
body: <p>On our website, administrators should be able to view the website as the user (client). I planned on using Auth0 for this, and just noticed their impersonation feature is deprecated.</p>
  
  <p>I could force some login flag in Redux to allow the admin to view as the user, however, to get any of the user's data from the API I'm grabbing the user's ID from the access token generated by Auth0 during login. So the API will only get data from the currently logged in user's access token.</p>
  
  <p>Does anybody know of any ways to impersonate a user given this? I think I've enforced a limitation on my API by parsing the user's ID from the access token to get any of that user's data, correct me if I'm wrong.</p>
  
  <p>The only way I could think of is if the admin is "viewing as" the user, it can pass the user's ID in the API call. And in the controller I could check that user ID field exists and use it instead of the current logged in user, but I don't think passing user IDs around is a good idea. Perhaps I could add a middleware on every request, and if that user ID exists in the API call, I could check the role of that user to ensure it's an admin which would validate the request.</p>
  
  <p>What do you think? Any other ideas / critiques on this method?</p>
  
  <p>Thanks!!</p>