We have an incident where a user of our client claimed that sensitive data was tempered with. The main issue is with the “Run As” feature, which does allows the Dev / Admin to impersonate a user and input data, without leaving any trace of this impersonation. Can this Run As be audited? Is there an…

[image] DjackLowCode: ‘Run As’ also starts the session with a redirect, so i wonder if this could be logged also. The URL syntax seems to suggest this is an editor URL not an app URL https://bubble.io/appeditor/authenticate_as/myapp/test/1111111111111x11111111111111/true/my_page I don’t thi…

@data1 open the network tab and you’ll see all the steps before arriving at the page as the User - the final one being a redirect from your app with the ?access_token=

[image] DjackLowCode: open the network tab and you’ll see all the steps before arriving at the page as the User - the final one being a redirect from your app with the ?access_token= Yes, I see that, though the token won’t be able to tell us which user was “ran as”, and we need to be able to …

@data1 , we’ll know what User it is as it’s the one that’s logged in. Just thinking out loud here, I haven’t looked into this in too much detail.

I see what you are saying. It’s a clue. However, it could be easily faked though, anyone could type access_token=some_uid in the URL and we could not assume log in. Moreover that app logs in with a proprietary SSO and the access_token URL parameter is already used. That would be confusing.

Here is a video that shows what will be in the URL when a user does the Run as [image] data1: However, it could be easily faked though, anyone could type access_token=some_uid in the URL and we could not assume log in. Now, yes, it is something that can be faked, but if you are going to lo…

There’s more than just the url. Check headers, pretty sure that it will include cookies and auth about the user authenticated to editor. This is how editor api request work. Same for file manager or scheduled workflow. I can generate all the same request outside of Bubble editor using correct auth c…

I use Spotify. Did song radio for Rico Suave So many late 80s, early 90s Hip Hop songs I hadn’t heard in 2 decades.

[image] boston85719: if there is a run as you perform a URL watch to store a data entry to log that, and see in logs no log in attempt, and see a an entry of the URL showing run as, that a application collaborator did it. Well, URL is client-side data in Bubble so can be manipulated and a use…

Audit "Run As" User

Need help Database

Jici September 14, 2025, 10:41pm 34

Just released that:

Not perfect, but for now, it can help you audit “Run as” click.

Topic		Replies	Views
"Run As →" feature needs to be completely revamped and is borderline illegal Questions	51	5778	October 31, 2023
Security Risk with Recommended Data Rules! Tips	41	947	December 7, 2024
Run As User Action for Backend Workflows Idea	9	347	December 31, 2024
Encrypt database Database	93	16450	March 24, 2023
How can I disable "run as" for app owner and developers? Need help	8	1030	January 25, 2023

Audit "Run As" User

Related topics