diff --git a/gns3server/modules/project.py b/gns3server/modules/project.py
index b12379a7..aceb2a2b 100644
--- a/gns3server/modules/project.py
+++ b/gns3server/modules/project.py
@@ -20,6 +20,7 @@ import os
 import tempfile
 import shutil
 from uuid import UUID, uuid4
+from ..config import Config
 
 
 class Project:
@@ -46,6 +47,10 @@ class Project:
         self._location = location
         if location is None:
             self._location = tempfile.mkdtemp()
+        else:
+            config = Config.instance().get_section_config("Server")
+            if config.get("local", False) is False:
+                raise aiohttp.web.HTTPForbidden(text="You are not allowed to modifiy the project directory location")
 
         self._temporary = temporary
         self._vms = set()
diff --git a/tests/api/test_project.py b/tests/api/test_project.py
index cfbe5f81..ee57954c 100644
--- a/tests/api/test_project.py
+++ b/tests/api/test_project.py
@@ -20,13 +20,15 @@ This test suite check /project endpoint
 """
 
 import uuid
+from unittest.mock import patch
 from tests.utils import asyncio_patch
 
 
 def test_create_project_with_dir(server, tmpdir):
-    response = server.post("/project", {"location": str(tmpdir)})
-    assert response.status == 200
-    assert response.json["location"] == str(tmpdir)
+    with patch("gns3server.config.Config.get_section_config", return_value={"local": True}):
+        response = server.post("/project", {"location": str(tmpdir)})
+        assert response.status == 200
+        assert response.json["location"] == str(tmpdir)
 
 
 def test_create_project_without_dir(server):
@@ -52,18 +54,11 @@ def test_create_project_with_uuid(server):
     assert response.json["uuid"] == "00010203-0405-0607-0809-0a0b0c0d0e0f"
 
 
-def test_create_project_with_uuid(server):
-    query = {"uuid": "00010203-0405-0607-0809-0a0b0c0d0e0f", "location": "/tmp"}
-    response = server.post("/project", query, example=True)
-    assert response.status == 200
-    assert response.json["uuid"] == "00010203-0405-0607-0809-0a0b0c0d0e0f"
-    assert response.json["location"] == "/tmp"
-
-
 def test_show_project(server):
     query = {"uuid": "00010203-0405-0607-0809-0a0b0c0d0e0f", "location": "/tmp", "temporary": False}
-    response = server.post("/project", query)
-    assert response.status == 200
+    with patch("gns3server.config.Config.get_section_config", return_value={"local": True}):
+        response = server.post("/project", query)
+        assert response.status == 200
     response = server.get("/project/00010203-0405-0607-0809-0a0b0c0d0e0f", example=True)
     assert response.json == query
 
diff --git a/tests/modules/test_project.py b/tests/modules/test_project.py
index 4aaee655..bc93b04c 100644
--- a/tests/modules/test_project.py
+++ b/tests/modules/test_project.py
@@ -18,6 +18,7 @@
 
 import os
 import pytest
+import aiohttp
 from unittest.mock import patch
 
 from gns3server.modules.project import Project
@@ -44,6 +45,7 @@ def test_affect_uuid():
     assert p.uuid == '00010203-0405-0607-0809-0a0b0c0d0e0f'
 
 
+@patch("gns3server.config.Config.get_section_config", return_value={"local": True})
 def test_path(tmpdir):
     p = Project(location=str(tmpdir))
     assert p.path == os.path.join(str(tmpdir), p.uuid)
@@ -56,27 +58,34 @@ def test_temporary_path():
     assert os.path.exists(p.path)
 
 
+@patch("gns3server.config.Config.get_section_config", return_value={"local": False})
+def test_changing_location_not_allowed(mock, tmpdir):
+    with pytest.raises(aiohttp.web.HTTPForbidden):
+        p = Project(location=str(tmpdir))
+
+
 def test_json(tmpdir):
     p = Project()
     assert p.__json__() == {"location": p.location, "uuid": p.uuid, "temporary": False}
 
 
+@patch("gns3server.config.Config.get_section_config", return_value={"local": True})
 def test_vm_working_directory(tmpdir, vm):
     p = Project(location=str(tmpdir))
     assert os.path.exists(p.vm_working_directory(vm))
     assert os.path.exists(os.path.join(str(tmpdir), p.uuid, vm.module_name, vm.uuid))
 
 
-def test_mark_vm_for_destruction(tmpdir, vm):
-    project = Project(location=str(tmpdir))
+def test_mark_vm_for_destruction(vm):
+    project = Project()
     project.add_vm(vm)
     project.mark_vm_for_destruction(vm)
     assert len(project._vms_to_destroy) == 1
     assert len(project.vms) == 0
 
 
-def test_commit(tmpdir, manager):
-    project = Project(location=str(tmpdir))
+def test_commit(manager):
+    project = Project()
     vm = VPCSVM("test", "00010203-0405-0607-0809-0a0b0c0d0e0f", project, manager)
     project.add_vm(vm)
     directory = project.vm_working_directory(vm)
@@ -89,23 +98,23 @@ def test_commit(tmpdir, manager):
     assert len(project.vms) == 0
 
 
-def test_project_delete(tmpdir):
-    project = Project(location=str(tmpdir))
+def test_project_delete():
+    project = Project()
     directory = project.path
     assert os.path.exists(directory)
     project.delete()
     assert os.path.exists(directory) is False
 
 
-def test_project_add_vm(tmpdir, manager):
-    project = Project(location=str(tmpdir))
+def test_project_add_vm(manager):
+    project = Project()
     vm = VPCSVM("test", "00010203-0405-0607-0809-0a0b0c0d0e0f", project, manager)
     project.add_vm(vm)
     assert len(project.vms) == 1
 
 
-def test_project_close(tmpdir, manager):
-    project = Project(location=str(tmpdir))
+def test_project_close(manager):
+    project = Project()
     vm = VPCSVM("test", "00010203-0405-0607-0809-0a0b0c0d0e0f", project, manager)
     project.add_vm(vm)
     with patch("gns3server.modules.vpcs.vpcs_vm.VPCSVM.close") as mock:
@@ -113,10 +122,10 @@ def test_project_close(tmpdir, manager):
         assert mock.called
 
 
-def test_project_close_temporary_project(tmpdir, manager):
+def test_project_close_temporary_project(manager):
     """A temporary project is deleted when closed"""
 
-    project = Project(location=str(tmpdir), temporary=True)
+    project = Project(temporary=True)
     directory = project.path
     assert os.path.exists(directory)
     project.close()