1 files changed, 4 insertions, 3 deletions
diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
index f41df1730b..77b173979e 100644
--- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb
+++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
@@ -102,15 +102,16 @@ module ActionController #:nodoc:
 
         # This is the method that defines the application behavior when a request is found to be unverified.
         def handle_unverified_request
-          request.session = NullSessionHash.new
+          request.session = NullSessionHash.new(request.env)
           request.env['action_dispatch.request.flash_hash'] = nil
           request.env['rack.session.options'] = { skip: true }
           request.env['action_dispatch.cookies'] = NullCookieJar.build(request)
         end
 
         class NullSessionHash < Rack::Session::Abstract::SessionHash #:nodoc:
-          def initialize
-            super(nil, nil)
+          def initialize(env)
+            super(nil, env)
+            @data = {}
             @loaded = true
           end