diff --git a/tests/auto/guhtestbase.cpp b/tests/auto/guhtestbase.cpp
index 3b1cc693..d5401559 100644
--- a/tests/auto/guhtestbase.cpp
+++ b/tests/auto/guhtestbase.cpp
@@ -307,10 +307,12 @@ void GuhTestBase::verifyReply(QNetworkReply *reply, const QByteArray &data, cons
     int statusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
     QCOMPARE(statusCode, expectedStatus);
 
-    QJsonParseError error;
-    QJsonDocument jsonDoc = QJsonDocument::fromJson(data, &error);
-    QCOMPARE(error.error, QJsonParseError::NoError);
-    Q_UNUSED(jsonDoc);
+    if (!data.isEmpty()) {
+        QJsonParseError error;
+        QJsonDocument jsonDoc = QJsonDocument::fromJson(data, &error);
+        QCOMPARE(error.error, QJsonParseError::NoError);
+        Q_UNUSED(jsonDoc);
+    }
 }
 
 bool GuhTestBase::enableNotifications()
diff --git a/tests/auto/restvendors/testrestvendors.cpp b/tests/auto/restvendors/testrestvendors.cpp
index 9213dffa..da646cab 100644
--- a/tests/auto/restvendors/testrestvendors.cpp
+++ b/tests/auto/restvendors/testrestvendors.cpp
@@ -43,6 +43,11 @@ class TestRestVendors: public GuhTestBase
 
 private slots:
     void getVendors();
+    void invalidMethod();
+    void invalidPath();
+
+    void invalidVendor_data();
+    void invalidVendor();
 };
 
 void TestRestVendors::getVendors()
@@ -63,6 +68,66 @@ void TestRestVendors::getVendors()
     }
 }
 
+void TestRestVendors::invalidMethod()
+{
+    QNetworkAccessManager *nam = new QNetworkAccessManager(this);
+    QSignalSpy clientSpy(nam, SIGNAL(finished(QNetworkReply*)));
+
+    QNetworkRequest request;
+    request.setUrl(QUrl("http://localhost:3333/api/v1/vendors"));
+    QNetworkReply *reply = nam->post(request, QByteArray());
+
+    clientSpy.wait();
+    QVERIFY2(clientSpy.count() == 1, "expected exactly 1 response from webserver");
+
+    bool ok = false;
+    int statusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(&ok);
+    QVERIFY2(ok, "Could not convert statuscode from response to int");
+    QCOMPARE(statusCode, 400);
+
+    reply->deleteLater();
+    nam->deleteLater();
+}
+
+void TestRestVendors::invalidPath()
+{
+    QNetworkAccessManager *nam = new QNetworkAccessManager(this);
+    QSignalSpy clientSpy(nam, SIGNAL(finished(QNetworkReply*)));
+
+    QNetworkRequest request;
+    request.setUrl(QUrl("http://localhost:3333/api/v1/vendors/" + QUuid::createUuid().toString() + "/" + QUuid::createUuid().toString()));
+    QNetworkReply *reply = nam->get(request);
+
+    clientSpy.wait();
+    QVERIFY2(clientSpy.count() == 1, "expected exactly 1 response from webserver");
+
+    bool ok = false;
+    int statusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(&ok);
+    QVERIFY2(ok, "Could not convert statuscode from response to int");
+    QCOMPARE(statusCode, 501);
+
+    reply->deleteLater();
+    nam->deleteLater();
+}
+
+void TestRestVendors::invalidVendor_data()
+{
+    QTest::addColumn<QString>("path");
+    QTest::addColumn<int>("expectedStatusCode");
+
+    QTest::newRow("invalid VendorId") << QUuid::createUuid().toString() << 404;
+    QTest::newRow("invalid VendorId format") << "uuid" << 400;
+}
+
+void TestRestVendors::invalidVendor()
+{
+    QFETCH(QString, path);
+    QFETCH(int, expectedStatusCode);
+
+    QNetworkRequest request(QUrl("http://localhost:3333/api/v1/vendors/" + path));
+    QVariant response = getAndWait(request, expectedStatusCode);
+    QCOMPARE(JsonTypes::deviceErrorToString(DeviceManager::DeviceErrorVendorNotFound), response.toMap().value("error").toString());
+}
 
 #include "testrestvendors.moc"
 QTEST_MAIN(TestRestVendors)
diff --git a/tests/auto/webserver/testwebserver.cpp b/tests/auto/webserver/testwebserver.cpp
index 292ec83b..401e14da 100644
--- a/tests/auto/webserver/testwebserver.cpp
+++ b/tests/auto/webserver/testwebserver.cpp
@@ -33,6 +33,7 @@
 #include <QCoreApplication>
 #include <QMetaType>
 #include <QByteArray>
+#include <QXmlReader>
 
 using namespace guhserver;
 
@@ -57,8 +58,7 @@ private slots:
     void getFiles_data();
     void getFiles();
 
-    void upnpDiscovery();
-
+    void getServerDescription();
 };
 
 void TestWebserver::httpVersion()
@@ -99,7 +99,6 @@ void TestWebserver::httpVersion()
 
 void TestWebserver::multiPackageMessage()
 {
-
     QTcpSocket *socket = new QTcpSocket(this);
     socket->connectToHost(QHostAddress("127.0.0.1"), 3333);
     bool connected = socket->waitForConnected(1000);
@@ -208,6 +207,7 @@ void TestWebserver::checkAllowedMethodCall()
         QCOMPARE(reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(), expectedStatusCode);
         QVERIFY2(reply->hasRawHeader("Allow"), "405 should contain the allowed methods header");
     }
+
     reply->deleteLater();
     nam->deleteLater();
 }
@@ -310,6 +310,7 @@ void TestWebserver::getOptions()
     QCOMPARE(statusCode, 200);
 
     reply->deleteLater();
+    nam->deleteLater();
 }
 
 void TestWebserver::getFiles_data()
@@ -318,6 +319,10 @@ void TestWebserver::getFiles_data()
     QTest::addColumn<int>("expectedStatusCode");
 
     QTest::newRow("get /etc/passwd") << "/etc/passwd" << 404;
+    QTest::newRow("get /blub/blub/blabla") << "/etc/passwd" << 404;
+    QTest::newRow("get /../../etc/passwd") << "/../../etc/passwd" << 404;
+    QTest::newRow("get /../../") << "/../../" << 403;
+    QTest::newRow("get /../") << "/../" << 403;
     QTest::newRow("get /etc/guh/guhd.conf") << "/etc/guh/guhd.conf" << 404;
     QTest::newRow("get /etc/sudoers") <<  "/etc/sudoers" << 404;
     QTest::newRow("get /root/.ssh/id_rsa.pub") <<  "/root/.ssh/id_rsa.pub" << 404;
@@ -344,40 +349,27 @@ void TestWebserver::getFiles()
     QCOMPARE(statusCode, expectedStatusCode);
 
     reply->deleteLater();
+    nam->deleteLater();
 }
 
-void TestWebserver::upnpDiscovery()
+void TestWebserver::getServerDescription()
 {
-    QUdpSocket *socket = new QUdpSocket(this);
-    socket->setSocketOption(QAbstractSocket::MulticastTtlOption,QVariant(1));
-    socket->setSocketOption(QAbstractSocket::MulticastLoopbackOption,QVariant(1));
+    QNetworkAccessManager *nam = new QNetworkAccessManager(this);
+    QSignalSpy clientSpy(nam, SIGNAL(finished(QNetworkReply*)));
 
-    QHostAddress host = QHostAddress("239.255.255.250");
+    QNetworkRequest request;
+    request.setUrl(QUrl("http://localhost:3333/server.xml"));
+    QNetworkReply *reply = nam->get(request);
 
-    QVERIFY(socket->bind(QHostAddress::AnyIPv4, 1900, QUdpSocket::ShareAddress));
-    QVERIFY(socket->joinMulticastGroup(host));
+    clientSpy.wait();
+    QVERIFY2(clientSpy.count() == 1, "expected exactly 1 response from webserver");
 
-    //QSignalSpy spy(socket, SIGNAL(readyRead()));
+    QXmlSimpleReader xmlReader; QXmlInputSource xmlSource;
+    xmlSource.setData(reply->readAll());
+    QVERIFY(xmlReader.parse(xmlSource));
 
-    QByteArray ssdpSearchMessage = QByteArray("M-SEARCH * HTTP/1.1\r\n"
-                                              "HOST:239.255.255.250:1900\r\n"
-                                              "MAN:\"ssdp:discover\"\r\n"
-                                              "MX:4\r\n"
-                                              "ST: ssdp:all\r\n\r\n");
-
-    socket->writeDatagram(ssdpSearchMessage, host, 1900);
-    socket->waitForBytesWritten();
-
-    socket->waitForReadyRead(2000);
-
-    qDebug() << socket->readAll();
-
-    //QVERIFY(spy.count() > 0);
-
-
-
-
-//    discovery->deleteLater();
+    reply->deleteLater();
+    nam->deleteLater();
 }
 
 #include "testwebserver.moc"
diff --git a/tests/auto/webserver/webserver.pro b/tests/auto/webserver/webserver.pro
index 6e516980..8d905544 100644
--- a/tests/auto/webserver/webserver.pro
+++ b/tests/auto/webserver/webserver.pro
@@ -1,5 +1,7 @@
 include(../../../guh.pri)
 include(../autotests.pri)
 
+QT += xml
+
 TARGET = webserver
 SOURCES += testwebserver.cpp