Merge branch 'master' into remove-ratelimit-session-update

README.md

@@ -6,10 +6,12 @@
 Tyk is a lightweight, open source API Gateway and Management Platform enables you to control who accesses your API, when they access it and how they access it. Tyk will
 also record detailed analytics on how your users are interacting with your API and when things go wrong.
 
-Go version 1.8 or later is required to build `master`, the current
+Go version 1.9 is required to build `master`, the current
 development version. Tyk is officially supported on `linux/amd64`,
 `linux/i386` and `linux/arm64`.
 
+Tests are run against both Go versions 1.9 & 1.10, however at present, only Go 1.9 is officially supported.
+
 ## What is an API Gateway?
 
 An API Gateway sits in front of your application(s) and manages the heavy lifting of authorisation, access control and throughput limiting to your services. Ideally, 

coprocess.go

@@ -136,13 +136,8 @@ func (c *CoProcessor) ObjectFromRequest(r *http.Request) *coprocess.Object {
 	if c.HookType != coprocess.HookType_Pre && c.HookType != coprocess.HookType_CustomKeyCheck {
 		if session := ctxGetSession(r); session != nil {
 			object.Session = ProtoSessionState(session)
-			// If the session contains metadata, add items to the object's metadata map:
-			if len(session.MetaData) > 0 {
-				object.Metadata = make(map[string]string)
-				for k, v := range session.MetaData {
-					object.Metadata[k] = v.(string)
-				}
-			}
+			// For compatibility purposes:
+			object.Metadata = object.Session.Metadata
 		}
 	}
 
@@ -278,7 +273,20 @@ func (m *CoProcessMiddleware) ProcessRequest(w http.ResponseWriter, r *http.Requ
 
 	coProcessor.ObjectPostProcess(returnObject, r)
 
-	token := returnObject.Metadata["token"]
+	var token string
+	if returnObject.Session != nil {
+		// For compatibility purposes, inject coprocess.Object.Metadata fields:
+		if returnObject.Metadata != nil {
+			if returnObject.Session.Metadata == nil {
+				returnObject.Session.Metadata = make(map[string]string)
+			}
+			for k, v := range returnObject.Metadata {
+				returnObject.Session.Metadata[k] = v
+			}
+		}
+
+		token = returnObject.Session.Metadata["token"]
+	}
 
 	// The CP middleware indicates this is a bad auth:
 	if returnObject.Request.ReturnOverrides.ResponseCode > 400 {