diff --git a/framework/CHANGELOG.md b/framework/CHANGELOG.md
index 220f1f22a35..0f1962c0b16 100644
--- a/framework/CHANGELOG.md
+++ b/framework/CHANGELOG.md
@@ -15,6 +15,7 @@ Yii Framework 2 Change Log
 - Bug #13828: Fix retrieving inserted data for a primary key of type uniqueidentifier for SQL Server 2005 or later (darkdef)
 - Bug #17474: Fix retrieving inserted data for a primary key of type trigger for SQL Server 2005 or later (darkdef)
 - Bug #18001: Fix getting table metadata for tables `(` in their name (floor12)
+- Enh #18083: Add `Controller::$request` and `$response` (brandonkelly)
 - Enh #18102: Use “primary”/“replica” terminology instead of “master”/“slave” (brandonkelly)
   - Added `yii\db\Connection::$enableReplicas` and deprecated `$enableSlaves` via magic methods.
   - Added `yii\db\Connection::$replicas` and deprecated `$slaves` via magic methods.
diff --git a/framework/base/Controller.php b/framework/base/Controller.php
index d934810d2f9..0b5fbffef26 100644
--- a/framework/base/Controller.php
+++ b/framework/base/Controller.php
@@ -8,6 +8,7 @@
 namespace yii\base;
 
 use Yii;
+use yii\di\Instance;
 
 /**
  * Controller is the base class for classes containing controller logic.
@@ -63,6 +64,16 @@ class Controller extends Component implements ViewContextInterface
      * by [[run()]] when it is called by [[Application]] to run an action.
      */
     public $action;
+    /**
+     * @var Request|array|string The request
+     * @since 2.0.36
+     */
+    public $request = 'request';
+    /**
+     * @var Response|array|string
+     * @since 2.0.36
+     */
+    public $response = 'response';
 
     /**
      * @var View the view object that can be used to render views or view files.
@@ -86,6 +97,17 @@ public function __construct($id, $module, $config = [])
         parent::__construct($config);
     }
 
+    /**
+     * {@inheritdoc}
+     * @since 2.0.36
+     */
+    public function init()
+    {
+        parent::init();
+        $this->request = Instance::ensure($this->request, Request::className());
+        $this->response = Instance::ensure($this->response, Response::className());
+    }
+
     /**
      * Declares external actions for the controller.
      *
diff --git a/framework/console/Controller.php b/framework/console/Controller.php
index aa5021aeb76..7126a50d7f3 100644
--- a/framework/console/Controller.php
+++ b/framework/console/Controller.php
@@ -34,6 +34,8 @@
  * read-only.
  * @property array $passedOptions The names of the options passed during execution. This property is
  * read-only.
+ * @property Request $request
+ * @property Response $response
  *
  * @author Qiang Xue <qiang.xue@gmail.com>
  * @since 2.0
diff --git a/framework/web/Controller.php b/framework/web/Controller.php
index 0175f0f5e5e..f8be7a8bc6d 100644
--- a/framework/web/Controller.php
+++ b/framework/web/Controller.php
@@ -18,6 +18,8 @@
  *
  * For more details and usage information on Controller, see the [guide article on controllers](guide:structure-controllers).
  *
+ * @property Request $request
+ * @property Response $response
  * @author Qiang Xue <qiang.xue@gmail.com>
  * @since 2.0
  */
@@ -72,10 +74,9 @@ public function renderAjax($view, $params = [])
      */
     public function asJson($data)
     {
-        $response = Yii::$app->getResponse();
-        $response->format = Response::FORMAT_JSON;
-        $response->data = $data;
-        return $response;
+        $this->response->format = Response::FORMAT_JSON;
+        $this->response->data = $data;
+        return $this->response;
     }
 
     /**
@@ -99,10 +100,9 @@ public function asJson($data)
      */
     public function asXml($data)
     {
-        $response = Yii::$app->getResponse();
-        $response->format = Response::FORMAT_XML;
-        $response->data = $data;
-        return $response;
+        $this->response->format = Response::FORMAT_XML;
+        $this->response->data = $data;
+        return $this->response;
     }
 
     /**
@@ -200,7 +200,7 @@ public function bindActionParams($action, $params)
     public function beforeAction($action)
     {
         if (parent::beforeAction($action)) {
-            if ($this->enableCsrfValidation && Yii::$app->getErrorHandler()->exception === null && !Yii::$app->getRequest()->validateCsrfToken()) {
+            if ($this->enableCsrfValidation && Yii::$app->getErrorHandler()->exception === null && !$this->request->validateCsrfToken()) {
                 throw new BadRequestHttpException(Yii::t('yii', 'Unable to verify your data submission.'));
             }
 
@@ -239,7 +239,7 @@ public function beforeAction($action)
     public function redirect($url, $statusCode = 302)
     {
         // calling Url::to() here because Response::redirect() modifies route before calling Url::to()
-        return Yii::$app->getResponse()->redirect(Url::to($url), $statusCode);
+        return $this->response->redirect(Url::to($url), $statusCode);
     }
 
     /**
@@ -256,7 +256,7 @@ public function redirect($url, $statusCode = 302)
      */
     public function goHome()
     {
-        return Yii::$app->getResponse()->redirect(Yii::$app->getHomeUrl());
+        return $this->response->redirect(Yii::$app->getHomeUrl());
     }
 
     /**
@@ -279,7 +279,7 @@ public function goHome()
      */
     public function goBack($defaultUrl = null)
     {
-        return Yii::$app->getResponse()->redirect(Yii::$app->getUser()->getReturnUrl($defaultUrl));
+        return $this->response->redirect(Yii::$app->getUser()->getReturnUrl($defaultUrl));
     }
 
     /**
@@ -299,6 +299,6 @@ public function goBack($defaultUrl = null)
      */
     public function refresh($anchor = '')
     {
-        return Yii::$app->getResponse()->redirect(Yii::$app->getRequest()->getUrl() . $anchor);
+        return $this->response->redirect($this->request->getUrl() . $anchor);
     }
 }
diff --git a/tests/framework/console/controllers/CacheControllerTest.php b/tests/framework/console/controllers/CacheControllerTest.php
index 9b8df4f146b..9f5f127afb8 100644
--- a/tests/framework/console/controllers/CacheControllerTest.php
+++ b/tests/framework/console/controllers/CacheControllerTest.php
@@ -33,11 +33,6 @@ protected function setUp()
     {
         parent::setUp();
 
-        $this->_cacheController = Yii::createObject([
-            'class' => 'yiiunit\framework\console\controllers\SilencedCacheController',
-            'interactive' => false,
-        ], [null, null]); //id and module are null
-
         $databases = self::getParam('databases');
         $config = $databases[$this->driverName];
         $pdoDriver = 'pdo_' . $this->driverName;
@@ -73,6 +68,11 @@ protected function setUp()
             ],
         ]);
 
+        $this->_cacheController = Yii::createObject([
+            'class' => 'yiiunit\framework\console\controllers\SilencedCacheController',
+            'interactive' => false,
+        ], [null, null]); //id and module are null
+
         if (isset($config['fixture'])) {
             Yii::$app->db->open();
             $lines = explode(';', file_get_contents($config['fixture']));
diff --git a/tests/framework/web/ControllerTest.php b/tests/framework/web/ControllerTest.php
index 3e7cfa64271..fd2048cc1ab 100644
--- a/tests/framework/web/ControllerTest.php
+++ b/tests/framework/web/ControllerTest.php
@@ -246,6 +246,7 @@ public function testRedirect()
     protected function setUp()
     {
         parent::setUp();
+        $this->mockWebApplication();
         $this->controller = new FakeController('fake', new \yii\web\Application([
             'id' => 'app',
             'basePath' => __DIR__,
@@ -258,6 +259,6 @@ protected function setUp()
                 ],
             ],
         ]));
-        $this->mockWebApplication(['controller' => $this->controller]);
+        Yii::$app->controller = $this->controller;
     }
 }