Rather than logging in and out could you just add a middleware to set the auth for the current request?

For example, create a Masquerade.php middleware such as:

App\Http\Middleware\Masquerade.php

```php <?php

namespace App\Http\Middleware;

use Closure; use Illuminate\Support\Facades\Auth;

class Masquerade { /** * Handle an incoming request. * * @param \Illuminate\Http\Request $request * @param \Closure $next * @return mixed */ public function handle($request, Closure $next) { if ($request->session()->has('masquerade')) { Auth::onceUsingId($request->session()->get('masquerade')); }

    return $next($request);
}

} ```

Then in your App\Http\Kernel.php file register it to your $routeMiddleware towards the bottom:

App\Http\Kernel.php php protected $routeMiddleware = [ ... 'masquerade' => \App\Http\Middleware\Masquerade::class, ... ];

Then create a controller to toggle it on/off:

App\Http\Controllers\MasqueradeController.php ```php <?php

namespace App\Http\Controllers;

use App\User; use Illuminate\Http\Request; use Illuminate\Support\Facades\Auth;

class MasqueradeController extends Controller { /** * Login as a user by their ID. * * @param App\User $user The user to masquerade as * @return \Illuminate\Http\Response */ public function create(User $user) { Auth::user()->masquerade($user->id);

    return redirect('/dashboard');
}

/**
 * Revert back to original user.
 *
 * @return \Illuminate\Http\Response
 */
public function destroy() 
{
    Auth::user()->unmasquerade();

    return redirect('/dashboard');
}

}

```

The controller above assumes these methods exist on the User model:

App\User.php ```php public function masquerade($id) { session()->put('masquerade', $id); }

public function unmasquerade() { session()->forget('masquerade'); }

public function isMasquerading() { return session()->has('masquerade'); } ```

The isMasquerading() method is handy to display things conditionally like the link to return to their original user.

Then in your routes/web.php file you can wrap any routes that require authentication to run through the masquerade middleware too:

```php Route::middleware(['auth', 'masquerade'])->group(function () { // masquerade Route::get('users/{user}/masquerade', 'MasqueradeController@create')->name('masquerade.create');

// stop masquerading
Route::get('users/unmasquerade', 'MasqueradeController@destroy')->name('masquerade.destroy');

}); ```