1 files changed, 28 insertions, 10 deletions
diff --git a/actionpack/lib/action_controller/railtie.rb b/actionpack/lib/action_controller/railtie.rb
index 28b20052b5..7d42f5d931 100644
--- a/actionpack/lib/action_controller/railtie.rb
+++ b/actionpack/lib/action_controller/railtie.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "rails"
 require "action_controller"
 require "action_dispatch/railtie"
@@ -11,7 +13,7 @@ module ActionController
 
     config.eager_load_namespaces << ActionController
 
-    initializer "action_controller.assets_config", :group => :all do |app|
+    initializer "action_controller.assets_config", group: :all do |app|
       app.config.action_controller.assets_dir ||= app.config.paths["public"].first
     end
 
@@ -22,13 +24,15 @@ module ActionController
     initializer "action_controller.parameters_config" do |app|
       options = app.config.action_controller
 
-      ActionController::Parameters.permit_all_parameters = options.delete(:permit_all_parameters) { false }
-      if app.config.action_controller[:always_permitted_parameters]
-        ActionController::Parameters.always_permitted_parameters =
-          app.config.action_controller.delete(:always_permitted_parameters)
-      end
-      ActionController::Parameters.action_on_unpermitted_parameters = options.delete(:action_on_unpermitted_parameters) do
-        (Rails.env.test? || Rails.env.development?) ? :log : false
+      ActiveSupport.on_load(:action_controller, run_once: true) do
+        ActionController::Parameters.permit_all_parameters = options.delete(:permit_all_parameters) { false }
+        if app.config.action_controller[:always_permitted_parameters]
+          ActionController::Parameters.always_permitted_parameters =
+            app.config.action_controller.delete(:always_permitted_parameters)
+        end
+        ActionController::Parameters.action_on_unpermitted_parameters = options.delete(:action_on_unpermitted_parameters) do
+          (Rails.env.test? || Rails.env.development?) ? :log : false
+        end
       end
     end
 
@@ -42,7 +46,7 @@ module ActionController
       options.javascripts_dir ||= paths["public/javascripts"].first
       options.stylesheets_dir ||= paths["public/stylesheets"].first
 
-      # Ensure readers methods get compiled
+      # Ensure readers methods get compiled.
       options.asset_host        ||= app.config.asset_host
       options.relative_url_root ||= app.config.relative_url_root
 
@@ -51,7 +55,7 @@ module ActionController
         extend ::AbstractController::Railties::RoutesHelpers.with(app.routes)
         extend ::ActionController::Railties::Helpers
 
-        options.each do |k,v|
+        options.each do |k, v|
           k = "#{k}="
           if respond_to?(k)
             send(k, v)
@@ -67,5 +71,19 @@ module ActionController
         config.compile_methods! if config.respond_to?(:compile_methods!)
       end
     end
+
+    initializer "action_controller.request_forgery_protection" do |app|
+      ActiveSupport.on_load(:action_controller_base) do
+        if app.config.action_controller.default_protect_from_forgery
+          protect_from_forgery with: :exception
+        end
+      end
+    end
+
+    initializer "action_controller.eager_load_actions" do
+      ActiveSupport.on_load(:after_initialize) do
+        ActionController::Metal.descendants.each(&:action_methods) if config.eager_load
+      end
+    end
   end
 end