diff --git a/tests/test_webinterface.py b/tests/test_webinterface.py
index 499a01a..e88af22 100644
--- a/tests/test_webinterface.py
+++ b/tests/test_webinterface.py
@@ -52,25 +52,30 @@ def client_authenticated(client):
 
     yield client
 
-
-def test_open_door_button(client_authenticated, mocker):
-    mocker.patch('imaginaerraum_door_admin.door_handle.DoorHandle.open_door')
+@pytest.mark.parametrize("url,function", [('/open', 'open_door'), ('/close', 'close_door')])
+def test_access_door_button(client_authenticated, mocker, url, function):
+    mocker.patch('imaginaerraum_door_admin.door_handle.DoorHandle.' + function)
 
     # visit route for open
-    client_authenticated.get('/open')
+    client_authenticated.get(url)
 
     # make sure the open method was called
-    DoorHandle.open_door.assert_called_once_with(user='gandalf')
+    getattr(DoorHandle, function).assert_called_once_with(user='gandalf')
 
 
-def test_close_door_button(client_authenticated, mocker):
-    mocker.patch('imaginaerraum_door_admin.door_handle.DoorHandle.close_door')
+@pytest.mark.parametrize("url,function", [('/open', 'open_door'), ('/close', 'close_door')])
+def test_access_door_unauthenticated(client, mocker, url, function):
+    # test for trying to visit opening/closing door while not logged in
+    mocker.patch('imaginaerraum_door_admin.door_handle.DoorHandle.' + function)
 
     # visit route for open
-    client_authenticated.get('/close')
+    response = client.get(url, follow_redirects=True)
 
-    # make sure the open method was called
-    DoorHandle.close_door.assert_called_once_with(user='gandalf')
+    # we should get redirected to login page
+    assert 'login' in response.request.url
+
+    # the open door function should not be called
+    getattr(DoorHandle, function).assert_not_called()
 
 
 def test_manage_admins(client_authenticated):