diff --git a/src/main/java/it/inaf/oats/vospace/BaseNodeController.java b/src/main/java/it/inaf/oats/vospace/BaseNodeController.java
new file mode 100644
index 0000000000000000000000000000000000000000..62bd0269545957e9c975add52a2107ddbb6bfc3c
--- /dev/null
+++ b/src/main/java/it/inaf/oats/vospace/BaseNodeController.java
@@ -0,0 +1,27 @@
+package it.inaf.oats.vospace;
+
+import javax.servlet.http.HttpServletRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+
+public abstract class BaseNodeController {
+
+    @Autowired
+    private HttpServletRequest servletRequest;
+
+    /**
+     * Slash is a special character in defining REST endpoints and trying to
+     * define a PathVariable containing slashes doesn't work, so the endpoint
+     * has been defined using "/nodes/**" instead of "/nodes/{path}" and the
+     * path is extracted manually parsing the request URL.
+     */
+    protected String getPath() {
+        String requestURL = servletRequest.getRequestURL().toString();
+        String[] split = requestURL.split("/nodes/");
+
+        String path = "/";
+        if (split.length == 2) {
+            path += split[1];
+        }
+        return path;
+    }
+}
diff --git a/src/main/java/it/inaf/oats/vospace/CreateNodeController.java b/src/main/java/it/inaf/oats/vospace/CreateNodeController.java
index 0367d0e925a15bae259240624aab0d962e1f9294..169f88b3ec356d93e53387d74395adce93be957a 100644
--- a/src/main/java/it/inaf/oats/vospace/CreateNodeController.java
+++ b/src/main/java/it/inaf/oats/vospace/CreateNodeController.java
@@ -1,43 +1,31 @@
 package it.inaf.oats.vospace;
 
+import it.inaf.ia2.aa.data.User;
 import net.ivoa.xml.vospace.v2.Node;
 import org.springframework.http.MediaType;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.beans.factory.annotation.Autowired;
-
 import it.inaf.oats.vospace.persistence.NodeDAO;
-
-import net.ivoa.xml.vospace.v2.Property;
-
 import java.util.List;
+import org.springframework.web.bind.annotation.PutMapping;
 
 @RestController
-public class CreateNodeController {
-    
-    @Autowired 
-    NodeDAO node_dao;
+public class CreateNodeController extends BaseNodeController {
 
-    @PostMapping(value = "/{path}",
+    @Autowired
+    private NodeDAO nodeDao;
+
+    @PutMapping(value = {"/nodes", "/nodes/**"},
             consumes = {MediaType.APPLICATION_XML_VALUE, MediaType.APPLICATION_JSON_VALUE},
-             produces = {MediaType.APPLICATION_XML_VALUE, MediaType.APPLICATION_JSON_VALUE})
-    public Node createNode(@PathVariable("path") String path, @RequestBody Node node) {
-        
-        System.out.println("In createNodeController");
-        node_dao.createNode(node);
-        return node;
-    }
-    
-    private class RequestWrapper {
+            produces = {MediaType.APPLICATION_XML_VALUE, MediaType.APPLICATION_JSON_VALUE})
+    public Node createNode(@RequestBody Node node, User principal) {
+
+        String path = getPath();
 
-    List<Property> nodeProperty;
-    String nodeId;
-    String nodeType;
-    
-    
-    
+        List<String> userGroups = principal.getGroups();
+
+        nodeDao.createNode(node);
+        return node;
     }
-    
 }
diff --git a/src/main/java/it/inaf/oats/vospace/ListNodeController.java b/src/main/java/it/inaf/oats/vospace/ListNodeController.java
index ed04f658d81a5a5d78dc5ae61010cec229ca191d..2a7ce2cdb2b7ad273676eabe7661d19c506a026f 100644
--- a/src/main/java/it/inaf/oats/vospace/ListNodeController.java
+++ b/src/main/java/it/inaf/oats/vospace/ListNodeController.java
@@ -12,7 +12,7 @@ import javax.servlet.http.HttpServletRequest;
 import org.springframework.http.MediaType;
 
 @RestController
-public class ListNodeController {
+public class ListNodeController extends BaseNodeController {
 
     @Autowired
     private NodeDAO nodeDAO;
@@ -20,24 +20,7 @@ public class ListNodeController {
     @GetMapping(value = {"/nodes", "/nodes/**"},
             produces = {MediaType.APPLICATION_XML_VALUE, MediaType.APPLICATION_JSON_VALUE, MediaType.TEXT_XML_VALUE})
     public ResponseEntity<Node> listNode(HttpServletRequest request) {
-        String path = getPath(request);
+        String path = getPath();
         return ResponseEntity.ok(nodeDAO.listNode(path));
     }
-
-    /**
-     * Slash is a special character in defining REST endpoints and trying to
-     * define a PathVariable containing slashes doesn't work, so the endpoint
-     * has been defined using "/nodes/**" instead of "/nodes/{path}" and the
-     * path is extracted manually parsing the request URL.
-     */
-    private String getPath(HttpServletRequest request) {
-        String requestURL = request.getRequestURL().toString();
-        String[] split = requestURL.split("/nodes/");
-
-        String path = "/";
-        if (split.length == 2) {
-            path += split[1];
-        }
-        return path;
-    }
 }
diff --git a/src/main/java/it/inaf/oats/vospace/PrivateController.java b/src/main/java/it/inaf/oats/vospace/PrivateController.java
deleted file mode 100644
index 7da6d80d28db19f4ca245efbb70a4d708142e46d..0000000000000000000000000000000000000000
--- a/src/main/java/it/inaf/oats/vospace/PrivateController.java
+++ /dev/null
@@ -1,23 +0,0 @@
-package it.inaf.oats.vospace;
-
-import javax.servlet.http.HttpServletRequest;
-import net.ivoa.xml.vospace.v2.Node;
-import org.springframework.http.MediaType;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RestController;
-import it.inaf.ia2.aa.data.User;
-
-@RestController
-public class PrivateController {
-
-    @GetMapping(value = "/private",
-             produces = {MediaType.APPLICATION_JSON_VALUE})
-    public User getUser(HttpServletRequest request) {
-        User user = (User)request.getUserPrincipal();
-        return user;
-    }
-
-}
diff --git a/src/main/java/it/inaf/oats/vospace/VospaceApplication.java b/src/main/java/it/inaf/oats/vospace/VospaceApplication.java
index 935377bb94d49931e784fdf5e89168255febe3dd..f815559a02f3ba6ef794304644115ca00e0924d9 100644
--- a/src/main/java/it/inaf/oats/vospace/VospaceApplication.java
+++ b/src/main/java/it/inaf/oats/vospace/VospaceApplication.java
@@ -4,7 +4,7 @@ import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
-import it.inaf.ia2.aa.LoginFilter;
+import it.inaf.ia2.aa.TokenFilter;
 
 @SpringBootApplication
 public class VospaceApplication {
@@ -14,10 +14,10 @@ public class VospaceApplication {
     }
 
     @Bean
-    public FilterRegistrationBean loginFilterRegistration() {
+    public FilterRegistrationBean tokenFilterRegistration() {
         FilterRegistrationBean registration = new FilterRegistrationBean();
-        registration.setFilter(new LoginFilter());
-        registration.addUrlPatterns("/private/*");
+        registration.setFilter(new TokenFilter());
+        registration.addUrlPatterns("/*");
         return registration;
     }
 }
diff --git a/src/test/java/it/inaf/oats/vospace/CreateNodeControllerTest.java b/src/test/java/it/inaf/oats/vospace/CreateNodeControllerTest.java
index d87c049576420de5c94cc7a0f824564f4e01f2e2..1323dc54b089fab3991643ac48ab9e4ffad05513 100644
--- a/src/test/java/it/inaf/oats/vospace/CreateNodeControllerTest.java
+++ b/src/test/java/it/inaf/oats/vospace/CreateNodeControllerTest.java
@@ -1,46 +1,44 @@
 package it.inaf.oats.vospace;
 
+import it.inaf.oats.vospace.persistence.NodeDAO;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import net.ivoa.xml.vospace.v2.Property;
 import net.ivoa.xml.vospace.v2.UnstructuredDataNode;
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
 import static org.mockito.ArgumentMatchers.argThat;
-import static org.mockito.ArgumentMatchers.eq;
-import org.mockito.InjectMocks;
 import static org.mockito.Mockito.verify;
-import org.mockito.Spy;
-import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.http.MediaType;
 import org.springframework.test.web.servlet.MockMvc;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.put;
 import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.print;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import org.springframework.test.web.servlet.setup.MockMvcBuilders;
-import org.junit.jupiter.api.Disabled;
-
-@ExtendWith(MockitoExtension.class)
+import static org.mockito.ArgumentMatchers.any;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.boot.test.mock.mockito.SpyBean;
+
+@SpringBootTest
+@AutoConfigureMockMvc
 public class CreateNodeControllerTest {
 
-    @InjectMocks
-    @Spy
+    @MockBean
+    private NodeDAO nodeDao;
+
+    @SpyBean
+    @Autowired
     private CreateNodeController controller;
 
+    @Autowired
     private MockMvc mockMvc;
 
-    @BeforeEach
-    public void init() {
-        mockMvc = MockMvcBuilders.standaloneSetup(controller).build();
-    }
-
     @Test
-    @Disabled
     public void testFromJsonToXml() throws Exception {
         String requestBody = getResourceFileContent("create-unstructured-data-node.json");
 
-        mockMvc.perform(post("/mypath")
+        mockMvc.perform(put("/nodes/mydata1")
                 .content(requestBody)
                 .contentType(MediaType.APPLICATION_JSON)
                 .accept(MediaType.APPLICATION_XML))
@@ -51,11 +49,10 @@ public class CreateNodeControllerTest {
     }
 
     @Test
-    @Disabled
     public void testFromXmlToJson() throws Exception {
         String requestBody = getResourceFileContent("create-unstructured-data-node.xml");
 
-        mockMvc.perform(post("/mypath")
+        mockMvc.perform(put("/nodes/mydata1")
                 .content(requestBody)
                 .contentType(MediaType.APPLICATION_XML)
                 .accept(MediaType.APPLICATION_JSON))
@@ -66,11 +63,10 @@ public class CreateNodeControllerTest {
     }
 
     @Test
-    @Disabled
     public void testFromXmlToXml() throws Exception {
         String requestBody = getResourceFileContent("create-unstructured-data-node.xml");
 
-        mockMvc.perform(post("/mypath")
+        mockMvc.perform(put("/nodes/mydata1")
                 .content(requestBody)
                 .contentType(MediaType.APPLICATION_XML)
                 .accept(MediaType.APPLICATION_XML))
@@ -81,11 +77,10 @@ public class CreateNodeControllerTest {
     }
 
     @Test
-    @Disabled
     public void testFromJsonToJson() throws Exception {
         String requestBody = getResourceFileContent("create-unstructured-data-node.json");
 
-        mockMvc.perform(post("/mypath")
+        mockMvc.perform(put("/nodes/mydata1")
                 .content(requestBody)
                 .contentType(MediaType.APPLICATION_JSON)
                 .accept(MediaType.APPLICATION_JSON))
@@ -96,14 +91,14 @@ public class CreateNodeControllerTest {
     }
 
     private void verifyArguments() {
-        verify(controller).createNode(eq("mypath"),
+        verify(controller).createNode(
                 argThat(node -> {
                     UnstructuredDataNode udn = (UnstructuredDataNode) node;
                     Property property = udn.getProperties().getProperty().get(0);
                     return "vos:UnstructuredDataNode".equals(udn.getType())
                             && "test value".equals(property.getValue())
                             && "ivo://ivoa.net/vospace/core#description".equals(property.getUri());
-                }));
+                }), any());
     }
 
     protected static String getResourceFileContent(String fileName) throws Exception {