diff --git a/lib/SyTest/HTTPClient.pm b/lib/SyTest/HTTPClient.pm
index cd3fa37ef..519e2c92c 100644
--- a/lib/SyTest/HTTPClient.pm
+++ b/lib/SyTest/HTTPClient.pm
@@ -83,6 +83,8 @@ sub do_request
    my $self = shift;
    my %params = @_;
 
+   croak "must give a method" unless $params{method};
+
    my $uri = $self->full_uri_for( %params );
 
    # Also set verify_mode = 0 to not complain about self-signed SSL certs
diff --git a/tests/10apidoc/00prepare.pl b/tests/10apidoc/00prepare.pl
index 5642cd0b7..fe1266626 100644
--- a/tests/10apidoc/00prepare.pl
+++ b/tests/10apidoc/00prepare.pl
@@ -13,6 +13,8 @@ sub do_request_json_for
    my ( $user, %args ) = @_;
    is_User( $user ) or croak "Expected a User";
 
+   croak "must give a method" unless $args{method};
+
    my $user_id = $user->user_id;
    ( my $uri = delete $args{uri} ) =~ s/:user_id/$user_id/g;
 
diff --git a/tests/10apidoc/02login.pl b/tests/10apidoc/02login.pl
index 2e0b1f093..2c9dc9c6f 100644
--- a/tests/10apidoc/02login.pl
+++ b/tests/10apidoc/02login.pl
@@ -37,6 +37,7 @@
       my ( $http ) = @_;
 
       $http->do_request_json(
+         method => "GET",
          uri => "/r0/login",
       )->then( sub {
          my ( $body ) = @_;
diff --git a/tests/10apidoc/32room-alias.pl b/tests/10apidoc/32room-alias.pl
index b28cc755f..9ffe20146 100644
--- a/tests/10apidoc/32room-alias.pl
+++ b/tests/10apidoc/32room-alias.pl
@@ -48,3 +48,50 @@
          Future->done(1);
       });
    };
+
+test "GET /rooms/:room_id/aliases lists aliases",
+   requires => [ $user_fixture, room_alias_fixture(), qw( can_create_room_alias )],
+
+   do => sub {
+      my ( $user, $room_alias ) = @_;
+      my ( $room_id );
+
+      matrix_create_room( $user )->then( sub {
+         ( $room_id ) = @_;
+
+         # the list should be empty initially
+         do_request_json_for(
+            $user,
+            method => "GET",
+            uri => "/r0/rooms/$room_id/aliases",
+         );
+      })->then( sub {
+         my ( $res ) = @_;
+         log_if_fail "response from /aliases", $res;
+
+         assert_json_keys( $res, qw( aliases ));
+         assert_json_empty_list( $res->{aliases} );
+
+         # now add an alias
+         do_request_json_for(
+            $user,
+            method => "PUT",
+            uri    => "/r0/directory/room/$room_alias",
+            content => { room_id => $room_id },
+         );
+      })->then( sub {
+         # ... and recheck
+         do_request_json_for(
+            $user,
+            method => "GET",
+            uri => "/r0/rooms/$room_id/aliases",
+         );
+      })->then( sub {
+         my ( $res ) = @_;
+         log_if_fail "response from /aliases", $res;
+
+         assert_json_keys( $res, qw( aliases ));
+         assert_deeply_eq($res->{aliases}, [ $room_alias ]);
+         Future->done;
+      });
+   };
diff --git a/tests/12login/02cas.pl b/tests/12login/02cas.pl
index bcda55305..854b4956a 100644
--- a/tests/12login/02cas.pl
+++ b/tests/12login/02cas.pl
@@ -33,6 +33,7 @@ sub wait_for_cas_request
       my ( $http ) = @_;
 
       $http->do_request_json(
+         method => "GET",
          uri => "/r0/login",
       )->then( sub {
          my ( $body ) = @_;
@@ -55,6 +56,7 @@ sub wait_for_cas_request
       my ( $http ) = @_;
 
       $http->do_request_json(
+         method => "GET",
          uri => "/r0/login",
       )->then( sub {
          my ( $body ) = @_;
diff --git a/tests/30rooms/05aliases.pl b/tests/30rooms/05aliases.pl
index 6fb63e0af..705e995a3 100644
--- a/tests/30rooms/05aliases.pl
+++ b/tests/30rooms/05aliases.pl
@@ -334,3 +334,35 @@ sub _test_can_create_and_delete_alias {
          Future->done(1);
       })
    };
+
+
+test "Only room members can list aliases of a room",
+   requires => [
+      $creator_fixture, $second_user_fixture, local_user_fixture(),
+   ],
+
+   do => sub {
+      my ( $creator, $other_user, $third_user ) = @_;
+      my ( $room_id );
+
+      matrix_create_and_join_room(
+         [ $creator, $other_user ],
+      )->then( sub {
+         ( $room_id ) = @_;
+         do_request_json_for(
+            $other_user,
+            method => "GET",
+            uri  => "/r0/rooms/$room_id/aliases",
+         );
+      })->then( sub {
+         my ( $res ) = @_;
+         log_if_fail "/aliases response for member", $res;
+         assert_json_nonempty_list( $res->{aliases} );
+
+         do_request_json_for(
+            $third_user,
+            method => "GET",
+            uri  => "/r0/rooms/$room_id/aliases",
+         );
+      })->main::expect_http_403;
+   };