diff --git a/src/test/java/it/inaf/oats/vospace/ListNodeControllerTest.java b/src/test/java/it/inaf/oats/vospace/ListNodeControllerTest.java
index 415e2b403099fa6f8f234d7baad4ccfd6458706c..54dc45ea3f58ee9bf07be55c6b92c8f53974c8c0 100644
--- a/src/test/java/it/inaf/oats/vospace/ListNodeControllerTest.java
+++ b/src/test/java/it/inaf/oats/vospace/ListNodeControllerTest.java
@@ -1,5 +1,6 @@
 package it.inaf.oats.vospace;
 
+import com.fasterxml.jackson.databind.ObjectMapper;
 import static it.inaf.oats.vospace.VOSpaceXmlTestUtil.loadDocument;
 import it.inaf.oats.vospace.datamodel.NodeProperties;
 import it.inaf.oats.vospace.persistence.NodeDAO;
@@ -35,6 +36,8 @@ public class ListNodeControllerTest {
 
     private static final String URI_PREFIX = "vos://example.com!vospace";
 
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+    
     @MockBean
     private NodeDAO dao;
 
@@ -107,6 +110,42 @@ public class ListNodeControllerTest {
                 .accept(MediaType.APPLICATION_XML))
                 .andExpect(status().is2xxSuccessful());       
     }
+    
+    //@Test
+    public void testListOnlyReadableChildren() throws Exception {
+
+        ContainerNode node = new ContainerNode();
+        node.setUri(URI_PREFIX + "/mynode");
+        Property creator = new Property();
+        creator.setUri(NodeProperties.CREATOR_URI);
+        creator.setValue("user1");
+        node.getProperties().add(creator);
+
+        // hidden node
+        Node child1 = getDataNodeByOwnership("user2", "group5");
+        child1.setUri(URI_PREFIX + "/mynode/child1");
+        node.getNodes().add(child1);
+        
+        // visible node
+        Node child2 = getDataNodeByOwnership("user1", "group1");
+        child2.setUri(URI_PREFIX + "/mynode/child2");
+        node.getNodes().add(child2);
+        
+        assertEquals(2, node.getNodes().size());
+
+        when(dao.listNode(eq("/mynode"))).thenReturn(Optional.of(node));
+
+        String response = mockMvc.perform(get("/nodes/mynode")
+                .header("Authorization", "Bearer user1_token")
+                .accept(MediaType.APPLICATION_JSON))
+                .andExpect(status().is2xxSuccessful())
+                .andReturn().getResponse().getContentAsString();
+        
+        ContainerNode result = MAPPER.readValue(response, ContainerNode.class);
+        
+        assertEquals(1, result.getNodes().size());
+        assertEquals(URI_PREFIX + "/mynode/child2", result.getNodes().get(0).getUri());
+    }
 
     private Optional<Node> getRootNode() {
         ContainerNode root = new ContainerNode();