diff --git a/pkg/web/macaron.go b/pkg/web/macaron.go
index 5a0567ff632..774f4d2d499 100644
--- a/pkg/web/macaron.go
+++ b/pkg/web/macaron.go
@@ -144,8 +144,14 @@ func mwFromHandler(handler Handler) Middleware {
 }
 
 func (m *Macaron) createContext(rw http.ResponseWriter, req *http.Request) *Context {
+	// NOTE: we have to explicitly copy the middleware chain here to avoid
+	// passing a shared slice to the *Context, which leads to racy behavior in
+	// case of later appends
+	mws := make([]Middleware, len(m.mws))
+	copy(mws, m.mws)
+
 	c := &Context{
-		mws:  m.mws,
+		mws:  mws,
 		Resp: NewResponseWriter(req.Method, rw),
 	}