diff --git a/tyk-docs/content/api-management/plugins/golang.md b/tyk-docs/content/api-management/plugins/golang.md
index c5aba22101..497c11f6e2 100644
--- a/tyk-docs/content/api-management/plugins/golang.md
+++ b/tyk-docs/content/api-management/plugins/golang.md
@@ -518,6 +518,13 @@ func MyPluginFunction(w http.ResponseWriter, r *http.Request) {
 }
 ```
 
+{{< note warning >}}
+**Note**  
+
+Tyk Gateway sets the session in the [Authentication layer]({{< ref "api-management/traffic-transformation#request-middleware-chain" >}}) of the middleware chain. Because of this, the session object does not exist until the middleware chain runs after the authentication middleware. If you call `ctx.GetSession` inside a custom auth plugin, it will always return an empty object.
+
+{{< /note >}}
+
 The invocation of `ctx.GetSession(r)` returns an SessionState object.
 The Go data structure can be found [here](https://github.com/TykTechnologies/tyk/blob/master/user/session.go#L106).