VP-2600: Force re-login when impersonating (#509)

VirtoCommerce · Aug 17, 2020 · 7c33a6f · 7c33a6f
1 parent a238352
commit 7c33a6f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/VirtoCommerce.Storefront/Controllers/AccountController.cs b/VirtoCommerce.Storefront/Controllers/AccountController.cs
@@ -259,7 +259,7 @@ public async Task<ActionResult> ConfirmEmail(string token)
         [HttpGet("impersonate/{userId}")]
         public async Task<IActionResult> ImpersonateUser(string userId)
         {
-            if (User.Identity.Name == SecurityConstants.AnonymousUsername)
+            if (User.Identity.Name == SecurityConstants.AnonymousUsername || User.Claims.Any(x => x.Type == SecurityConstants.Claims.OperatorUserNameClaimType))
             {
                 return StoreFrontRedirect($"~/account/login?ReturnUrl={Request.Path}");
             }