How to handle session for anonymous users for CSRF tokens?
So the solution to this problem is that something has to be saved into the session :)

  if (\Drupal::service('session')-&gt;isStarted() === FALSE) {
    \Drupal::service('session')-&gt;start();
    \Drupal::service('session')-&gt;set('foo', 'bar');
  }
  \Drupal::service('csrf_token')-&gt;get('baz');


Also, there is no need to call save() method.