diff --git a/src/main/java/eu/hbp/mip/controllers/SecurityApi.java b/src/main/java/eu/hbp/mip/controllers/SecurityApi.java
index a37c9e87a3dd2b5432a98d9f917ed779a54435e6..6fcb4c400d804ad4652c4f33f6da699a84a10c5c 100644
--- a/src/main/java/eu/hbp/mip/controllers/SecurityApi.java
+++ b/src/main/java/eu/hbp/mip/controllers/SecurityApi.java
@@ -55,7 +55,7 @@ public class SecurityApi {
         }
 
         if (!securityConfiguration.isAuthentication()) {
-            if (!userInfo.isFakeAuth()) {
+            if (userInfo.isFakeAuth()) {
                 response.setStatus(401);
             }
             String principalJson = "{\"principal\": \"anonymous\", \"name\": \"anonymous\", \"userAuthentication\": {" +