diff --git a/gms/src/main/java/it/inaf/ia2/gms/controller/JWTWebServiceController.java b/gms/src/main/java/it/inaf/ia2/gms/controller/JWTWebServiceController.java
index 04a382745cdfd0a76e2af33697c57bc22b4de6e8..a5ff5cf7df6bf77c446c8837caf8a206200be8e6 100644
--- a/gms/src/main/java/it/inaf/ia2/gms/controller/JWTWebServiceController.java
+++ b/gms/src/main/java/it/inaf/ia2/gms/controller/JWTWebServiceController.java
@@ -231,7 +231,7 @@ public class JWTWebServiceController {
         response.setStatus(HttpServletResponse.SC_NO_CONTENT);
     }
 
-    @GetMapping(value = {"/permission/{group:.+}", "/permission/"}, produces = MediaType.TEXT_PLAIN_VALUE)
+    @GetMapping(value = {"/permission/{group:.+}", "/permission"}, produces = MediaType.TEXT_PLAIN_VALUE)
     public void getUserPermission(@PathVariable("group") Optional<String> groupNames, @RequestParam("user_id") Optional<String> userId, HttpServletRequest request, HttpServletResponse response) throws IOException {
 
         if (userId.isPresent()) {
diff --git a/gms/src/main/java/it/inaf/ia2/gms/rap/RapClient.java b/gms/src/main/java/it/inaf/ia2/gms/rap/RapClient.java
index ddb51dbb0ab8c84f14e503a6259df0f5fff38cb5..5d8b2bde72af492fdd3886076d83182e95ce48aa 100644
--- a/gms/src/main/java/it/inaf/ia2/gms/rap/RapClient.java
+++ b/gms/src/main/java/it/inaf/ia2/gms/rap/RapClient.java
@@ -103,7 +103,7 @@ public class RapClient {
         try {
             return function.apply(getEntity(body));
         } catch (HttpClientErrorException.Unauthorized ex) {
-            if (sessionData == null) {
+            if (request.getSession(false) == null) {
                 // we can't refresh the token without a session
                 throw ex;
             }
@@ -116,7 +116,7 @@ public class RapClient {
 
         HttpHeaders headers = new HttpHeaders();
         headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON));
-        if (sessionData != null) {
+        if (request.getSession(false) != null) {
             headers.add("Authorization", "Bearer " + sessionData.getAccessToken());
         } else {
             // from JWT web service