1 files changed, 23 insertions, 0 deletions
diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
index 1598a2dc78..b7e6748cc9 100644
--- a/actionpack/CHANGELOG.md
+++ b/actionpack/CHANGELOG.md
@@ -1,3 +1,26 @@
+*   Allow you to pass `prepend: false` to protect_from_forgery to have the 
+    verification callback appended instead of prepended to the chain.
+    This allows you to let the verification step depend on prior callbacks.
+    Example:
+
+        class ApplicationController < ActionController::Base
+          before_action :authenticate
+          protect_from_forgery unless: -> { @authenticated_by.oauth? }
+
+          private
+            def authenticate
+              if oauth_request?
+                # authenticate with oauth
+                @authenticated_by = 'oauth'.inquiry
+              else
+                # authenticate with cookies
+                @authenticated_by = 'cookie'.inquiry
+              end
+            end
+        end
+
+    *Josef Šimánek*
+
 *   Remove `ActionController::HideActions`
 
     *Ravil Bayramgalin*