Ask HN: How do you implement “user impersonation” support? What are best practices for implementing a support system where support agents / engineers can see the app as the user sees it, including any bugs which may be occurring based on that user's data? Do most companies build this themselves with role based access control, access logging, automatically blocking any sensitive customer data or PII? Or are there tools on the market that do this? |
Most (small) startups I've worked at have usually had a homegrown solution with admin only access where you can login as the user.
However, these days, with more and more PII laws coming in, you do need to consider whether you really need it.
As you grow you have to add more checks, logging, etc., the user has to approve an access request, etc., to the point where you get bigger you don't allow it at all.
It's actually rare in my experience to need to impersonate a user to replicate bugs if you read their support request/ask the right questions, and can be a sign of an inexperienced dev if someone constantly asks for this. You have to put yourself in the mind of the user, what were they doing, what were they clicking, what were they trying to achieve. You'll usually be able to replicate it.
But another way to fix bugs due to complicated data interactions, when you're not allowed to access the data, is to have a script to anonymize the PII in a backup DB.
When do companies usually start not allowing this? I've heard of even facebook and google having this functionality?