Detect an impersonated User in Salesforce

How to detect impersonated user in Salesforce

​

Few months back I got a requirement to detect impersonated user in Salesforce, client was having some security concerns for which they want us to bypass access for impersonated user.

​

Initially I thought it would be easy to detect it in SF and there would be something in SF to detect it, but my prediction was wrong, I moved down site to site and blog to blog, but I didn't find any solution.

​​

I spent 2 days in searching this and talked to many technical guys, but none of them was having solution, then just randomly an idea came to my mind to check out its cookies structure, I did POC there and unbelievably I found a solution.

​​

Solution: Login into SF as a normal user and check the cookies, you will see a cookie with a name "sid" where SF used to store user's session id, now "Login as" with some another user in the same SF instance.

​​

Review again your browser's cookies, and you will find one more cookie with name "RSID" along with "SID". The next step for me is to access that cookie through code, and here also I faced another issue that we cannot access cookies created by SF itself.

​

The final workaround for this issue is, we need to access "RSID" cookie using javascript and create our own cookie which can be accessible through code.

​

Finally, I implemented this solution which is working very well.