2 files changed, 25 insertions, 34 deletions
diff --git a/railties/lib/rails/generators/rails/app/app_generator.rb b/railties/lib/rails/generators/rails/app/app_generator.rb
index c288b3dfce..448dce06af 100644
--- a/railties/lib/rails/generators/rails/app/app_generator.rb
+++ b/railties/lib/rails/generators/rails/app/app_generator.rb
@@ -90,7 +90,6 @@ module Rails
 
     def config_when_updating
       cookie_serializer_config_exist = File.exist?('config/initializers/cookies_serializer.rb')
-      new_framework_defaults_config_exist = File.exist?('config/initializers/new_framework_defaults.rb')
       action_cable_config_exist = File.exist?('config/cable.yml')
       rack_cors_config_exist = File.exist?('config/initializers/cors.rb')
 
@@ -102,10 +101,6 @@ module Rails
         gsub_file 'config/initializers/cookies_serializer.rb', /json(?!,)/, 'marshal'
       end
 
-      unless new_framework_defaults_config_exist
-        remove_file 'config/initializers/new_framework_defaults.rb'
-      end
-
       unless action_cable_config_exist
         template 'config/cable.yml'
       end
diff --git a/railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults.rb.tt b/railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults.rb.tt
index 730938a1ba..13e2685a46 100644
--- a/railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults.rb.tt
+++ b/railties/lib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults.rb.tt
@@ -1,37 +1,33 @@
 # Be sure to restart your server when you modify this file.
-# This file contains all the new default configuration options from
-# Rails 5.0.
-<%- unless options[:skip_active_record] -%>
-
-# Require `belongs_to` associations by default. This is a new Rails 5.0
-# default, so it is introduced as a configuration option to ensure that apps
-# made on earlier versions of Rails are not affected when upgrading.
-Rails.application.config.active_record.belongs_to_required_by_default = true
+#
+# This file contains migration options to ease your Rails 5.0 upgrade.
+#
+<%- if options[:update] -%>
+# Once upgraded flip defaults one by one to migrate to the new default.
+#
 <%- end -%>
-
-# Do not halt callback chains when a callback returns false. This is a new
-# Rails 5.0 default, so it is introduced as a configuration option to ensure
-# that apps made with earlier versions of Rails are not affected when upgrading.
-ActiveSupport.halt_callback_chains_on_return_false = false
+# Read the Rails 5.0 release notes for more info on each option.
 <%- unless options[:api] -%>
 
-# Enable per-form CSRF tokens.
-Rails.application.config.action_controller.per_form_csrf_tokens = true
+# Enable per-form CSRF tokens. <%= options[:update] ? 'Next major version defaults to true.' : 'Previous versions had false.' %>
+Rails.application.config.action_controller.per_form_csrf_tokens = <%= options[:update] ? false : true %>
 
-# Enable origin-checking CSRF mitigation.
-Rails.application.config.action_controller.forgery_protection_origin_check = true
+# Enable origin-checking CSRF mitigation. <%= options[:update] ? 'Next major version defaults to true.' : 'Previous versions had false.' %>
+Rails.application.config.action_controller.forgery_protection_origin_check = <%= options[:update] ? false : true %>
 <%- end -%>
 
-# Configure SSL options to enable HSTS with subdomains. This is a new
-# Rails 5.0 default, so it is introduced as a configuration option to ensure
-# that apps made on earlier versions of Rails are not affected when upgrading.
-Rails.application.config.ssl_options = { hsts: { subdomains: true } }
-
-# Preserve the timezone of the receiver when calling to `to_time`.
-# Ruby 2.4 will change the behavior of `to_time` to preserve the timezone
-# when converting to an instance of `Time` instead of the previous behavior
-# of converting to the local system timezone.
-#
-# Rails 5.0 introduced this config option so that apps made with earlier
-# versions of Rails are not affected when upgrading.
+# Make Ruby 2.4 preserve the timezone of the receiver when calling `to_time`.
 ActiveSupport.to_time_preserves_timezone = true
+<%- unless options[:skip_active_record] -%>
+
+# Require `belongs_to` associations by default. <%= options[:update] ? 'Next major version defaults to true.' : 'Previous versions had false.' %>
+Rails.application.config.active_record.belongs_to_required_by_default = <%= options[:update] ? false : true %>
+<%- end -%>
+
+# Do not halt callback chains when a callback returns false. <%= options[:update] ? 'Next major version defaults to false.' : 'Previous versions had true.' %>
+ActiveSupport.halt_callback_chains_on_return_false = <%= options[:update] ? true : false %>
+<%- unless options[:update] -%>
+
+# Configure SSL options to enable HSTS with subdomains. Previous versions had false.
+Rails.application.config.ssl_options = { hsts: { subdomains: true } }
+<%- end -%>