How does "config/initializers/new_framework_defaults_5_2.rb" work?

Question

Specifically...

I don't understand how in a new Rails 5.2 app, if you enter the console and check Rails.application.config.action_controller.default_protect_from_forgery it'll return true

...but an upgraded Rails 5.2 app, if you enter the console and check Rails.application.config.action_controller.default_protect_from_forgery it'll return nil (unless you've manually set in config/initializers/new_framework_defaults_5_2.rb)

This GitHub comment mentions this behavior, but I don't understand how this works & I haven't been able to find any documentation yet.

WIP Update: This issue seems like the point where it was decided to not include new_framework_defaults* files in newly generated apps. Then this pull request mentions that new_framework_defaults_* files are only kept on a rolling basis. I'm still looking into why/how...

Answer 1

To load the defaults (i.e config/initializers/new_framework_defaults_5_2.rb) in Rails 5.2, make the following change in application.rb

config.load_defaults 5.2

Then remove new_framework_defaults_5_2.rb from initializers