title: Looking for authentication/impersonation strategies for a RESTful API
body: <p>I've got a requirement to allow impersonation ("act as") in my API.  So a user with the appropriate permission can exercise the API as another user.  I'm wondering if there are some specific strategies employed in this space?</p>
  
  <p>I can create an endpoint to begin and end the impersonation.  Beginning the impersonation might involve getting a user and their permissions and loading them into memory for the current request, easy enough.  What about subsequent requests?  Is it bad practice to add an HTTP header indicating a "Impersonated-User"? If that header exists, use it to do auth on subsequent requests?  What about using a cookie with that UserId? Or additional information?</p>
  
  <p>Is there added benefit (assuming a .NET impl) to assigning the impersonated users to the Thread.CurrentPrincipal? The current permission and role implementation is custom, essentially using a bit array (although this is on the table for change in the future).</p>