diff --git a/.gitignore b/.gitignore
index f7c175cc3..d2adb9dfb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@ build/
 ###
 !bin/verdaccio
 test-storage*
+access-storage*
 .verdaccio_test_env
 node_modules
 package-lock.json
diff --git a/test/unit/api.pkg.access.spec.js b/test/unit/api.pkg.access.spec.js
new file mode 100644
index 000000000..670dfe898
--- /dev/null
+++ b/test/unit/api.pkg.access.spec.js
@@ -0,0 +1,69 @@
+import request from 'supertest';
+import _ from 'lodash';
+import path from 'path';
+import rimraf from 'rimraf';
+
+import configDefault from './partials/config/access';
+import Config from '../../src/lib/config';
+import Storage from '../../src/lib/storage';
+import Auth from '../../src/lib/auth';
+import indexAPI from '../../src/api/index';
+
+require('../../src/lib/logger').setup([]);
+
+describe('api with no limited access configuration', () => {
+  let config;
+  let storage;
+  let auth;
+  let app;
+
+  beforeAll(function(done) {
+    const store = path.join(__dirname, '../partials/store/access-storage');
+    rimraf(store, () => {
+      const configForTest = _.clone(configDefault);
+      configForTest.auth = {
+        htpasswd: {
+          file: './access-storage/htpasswd-access-test'
+        }
+      };
+      configForTest.self_path = store;
+      config = new Config(configForTest);
+      storage = new Storage(config);
+      auth = new Auth(config);
+      app = indexAPI(config, auth, storage);
+      done();
+    });
+  });
+
+  describe('test proxy packages partially restricted', () => {
+
+    test('should test fails on fetch endpoint /-/jquery', (done) => {
+      request(app)
+        .get('/jquery')
+        .set('content-type', 'application/json; charset=utf-8')
+        .expect('Content-Type', /json/)
+        .expect(404)
+        .end(function(err, res) {
+          if (err) {
+            return done(err);
+          }
+          done();
+        });
+    });
+
+    test('should success on fetch endpoint /-/react', (done) => {
+      request(app)
+        .get('/react')
+        .set('content-type', 'application/json; charset=utf-8')
+        .expect('Content-Type', /json/)
+        .expect(200)
+        .end(function(err, res) {
+          if (err) {
+            return done(err);
+          }
+          done();
+        });
+    });
+  });
+
+});
diff --git a/test/unit/partials/config/access.js b/test/unit/partials/config/access.js
new file mode 100644
index 000000000..3e63b08d4
--- /dev/null
+++ b/test/unit/partials/config/access.js
@@ -0,0 +1,26 @@
+import path from 'path';
+
+const config = {
+  storage: path.join(__dirname, '../store/access-storage'),
+  uplinks: {
+    'npmjs': {
+      'url': 'https://registry.npmjs.org/'
+    }
+  },
+  packages: {
+    'jquery': {
+      allow_access: '$all',
+      allow_publish: '$all'
+    },
+    '**': {
+      allow_access: '$all',
+      allow_publish: '$all',
+      proxy: 'npmjs'
+    }
+  },
+  logs: [
+    {type: 'stdout', format: 'pretty', level: 'fatal'},
+  ],
+};
+
+module.exports = config;