See the following scenario.
I have some custom module that allows the frontend user to perform some actions on some custom entities. (details are not really important).
The request is that an admin should be able to login on the frontend with the customer account (without having the password) and be able to perform those actions for the customer.
Since you cannot use the the frontend session from the backend and I don't want to create a permanent autologin link for frontend since is might be a big security hole this is what I did so far.
- add an empty attribute for the customer entity. (let's call it
login_key
) - add a button in the backend on the customer edit page that redirects to an admin page where a random string is generated and saved in the attribute
login_key
. - in the same action I redirect the admin to a frontend url like this
autologin/index/index/customer_id/7/login_key/ajkshdkjah123123
(value generated in previous step). - at the frontend url, if the customer id and
login_key
match for a specific customer then I set the customer object in session (as logged in) and delete thelogin_key
so the url won't work in the future.
This seams to work. I mean, I get logged in as the selected customer and the link used for autologin does not work a second time.
The down side is that if 2 admins click on the "autologin" button around the same time, one will fail to login, but this is an acceptable risk.
My main concern is that this may also be a (not that) big security issue. Can someone see something wrong with this approach? or suggest a better one?
Ignore the fact that the customer accounts can be separated by website. This is not important and also can be managed easily.
Best Answer
Since no one came up with a good reason not to do what I was asking I assume that my method is kind of safe. So, in order not to leave this question open, I decided to add the code as an answer and mark it as accepted.
So I have a new extension called
Easylife_Simulate
with the following files:app/etc/modules/Easylife_Simulte.xml
- the declaration file:app/code/local/Easylife/Simulte/etc/config.xml
- the configuration fileapp/code/local/Easylife/Simulate/sql/easylife_simulate_setup/install-0.0.1.php
- install script - adds a new customer attribute:app/code/local/Easylife/Simulate/Model/Observer.php
- observer to add a button in the customer admin edit formapp/code/local/Easylife/Simulate/controllers/Adminhtml/SimulateController.php
- the admin controller that handles the click on the button generated above.app/code/local/Easylife/Simulate/controllers/IndexController.php
- the frontend controller that makes the autologin.app/code/local/Easylife/Simulte/Helper/Data.php
- the module helperThat's it. It seams to work for me. Like I said in the question, the downside is that if 2 admins press the login button for the same customer at (approximately) the same time, one of them will not be logged in. But he can repeat the process a few seconds later.