diff --git a/http/good.go b/http/good.go
index 2fe6e1f..64507e4 100644
--- a/http/good.go
+++ b/http/good.go
@@ -10,6 +10,7 @@ import (
 	lib "github.com/genofire/hs_master-kss-monolith/lib/http"
 	logger "github.com/genofire/hs_master-kss-monolith/lib/log"
 	"github.com/genofire/hs_master-kss-monolith/models"
+	"github.com/genofire/hs_master-kss-monolith/runtime"
 )
 
 func addGood(w http.ResponseWriter, r *http.Request) {
@@ -21,17 +22,29 @@ func addGood(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	log = log.WithField("productid", id)
-	var obj *models.Good
-	lib.Read(r, obj)
+	ok, err := runtime.ProductExists(id)
+	if err != nil {
+		log.Warn(err.Error())
+		http.Error(w, err.Error(), http.StatusGatewayTimeout)
+		return
+	}
+	if !ok {
+		log.Warn("wrong product not found")
+		http.Error(w, "wrong product not found", http.StatusNotFound)
+		return
+	}
+
+	var obj models.Good
+	lib.Read(r, &obj)
 
 	obj.ProductID = id
 
-	db := database.Write.Create(obj)
+	db := database.Write.Create(&obj)
 	if db.Error != nil {
 		log.Error("database could not write", db.Error)
 		http.Error(w, "was not possible to write", http.StatusInternalServerError)
 	}
-	lib.Write(w, obj)
+	lib.Write(w, &obj)
 
 	log.Info("done")
 }
diff --git a/http/good_test.go b/http/good_test.go
new file mode 100644
index 0000000..8619d04
--- /dev/null
+++ b/http/good_test.go
@@ -0,0 +1,69 @@
+package http
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/genofire/hs_master-kss-monolith/lib/database"
+	"github.com/genofire/hs_master-kss-monolith/models"
+	"github.com/genofire/hs_master-kss-monolith/runtime"
+	"github.com/genofire/hs_master-kss-monolith/test"
+)
+
+func TestAddGood(t *testing.T) {
+	assertion, router := test.Init(t)
+
+	BindAPI(router)
+	runtime.PermissionURL = "http://localhost:8080/api-test/session/%s/%d/"
+	session := test.NewSession(router)
+
+	good := models.Good{
+		ProductID: 3,
+		Comment:   "blub",
+	}
+
+	_, w := session.JSONRequest("POST", "/api/good/1", good)
+	assertion.Equal(http.StatusNonAuthoritativeInfo, w.StatusCode)
+
+	session.Login()
+
+	_, w = session.JSONRequest("POST", "/api/good/a", good)
+	assertion.Equal(http.StatusNotAcceptable, w.StatusCode)
+
+	_, w = session.JSONRequest("POST", "/api/good/4", good)
+	assertion.Equal(http.StatusNotFound, w.StatusCode)
+
+	_, w = session.JSONRequest("POST", "/api/good/1", good)
+	assertion.Equal(http.StatusOK, w.StatusCode)
+
+	database.Close()
+
+	_, w = session.JSONRequest("POST", "/api/good/1", good)
+	assertion.Equal(http.StatusInternalServerError, w.StatusCode)
+
+	session.Logout()
+
+	_, w = session.JSONRequest("POST", "/api/good/1", good)
+	assertion.Equal(http.StatusForbidden, w.StatusCode)
+
+	session.Login()
+	runtime.CacheConfig.After = models.Duration{Duration: time.Duration(5) * time.Millisecond}
+	test.CloseServer()
+	time.Sleep(time.Duration(10) * time.Millisecond)
+	runtime.HasPermission("testsessionkey", runtime.PermissionCreateGood)
+	runtime.CleanCache()
+
+	// Test gatewaytimeout on product exists
+	_, w = session.JSONRequest("POST", "/api/good/1", good)
+	assertion.Equal(http.StatusGatewayTimeout, w.StatusCode)
+
+	time.Sleep(time.Duration(10) * time.Millisecond)
+	runtime.CleanCache()
+
+	// Test gatewaytimeout on permission exists
+	_, w = session.JSONRequest("POST", "/api/good/1", good)
+	assertion.Equal(http.StatusGatewayTimeout, w.StatusCode)
+
+	test.Close()
+}
diff --git a/lib/database/database.go b/lib/database/database.go
index 52f2a49..300b112 100644
--- a/lib/database/database.go
+++ b/lib/database/database.go
@@ -69,11 +69,9 @@ func Open(c Config) (err error) {
 // Function to safely close the database
 func Close() {
 	Write.Close()
-	Write = nil
 	if len(config.ReadConnection) > 0 {
 		Read.Close()
 	}
-	Read = nil
 }
 
 // Function to add a model to the runtime
diff --git a/runtime/auth.go b/runtime/auth.go
index e151785..518d6d7 100644
--- a/runtime/auth.go
+++ b/runtime/auth.go
@@ -41,11 +41,17 @@ func (c *permissionMicroServiceCache) HasPermission(p Permission) (bool, error)
 
 	url := fmt.Sprintf(PermissionURL, c.session, p)
 	log.Log.WithField("url", url).Info("has permission?")
+
 	res, err := http.Get(url)
 
+	value := false
+	if err == nil {
+		value = (res.StatusCode == http.StatusOK)
+	}
+
 	c.permissions[p] = boolMicroServiceCache{
 		LastCheck: c.LastCheck,
-		Value:     (res.StatusCode == http.StatusOK),
+		Value:     value,
 	}
 	return c.permissions[p].Value, err
 }
diff --git a/test/testrest.go b/test/testrest.go
index b493608..4ae7f93 100644
--- a/test/testrest.go
+++ b/test/testrest.go
@@ -79,6 +79,18 @@ func (r *Request) JSONRequest(method string, url string, body interface{}) (json
 	return
 }
 
+// login the current session
+func (r *Request) Login() {
+	r.cookies = nil
+	r.cookies = append(r.cookies, &http.Cookie{Name: "session", Value: "testsessionkey"})
+}
+
+// logout the current session
+func (r *Request) Logout() {
+	r.cookies = nil
+	r.cookies = append(r.cookies, &http.Cookie{Name: "session", Value: "trashkey"})
+}
+
 // clean the current session
 func (r *Request) Clean() {
 	r.cookies = nil