title: Angular 6 does not add X-XSRF-TOKEN header to http request
body: <p>I've read <a href="https://angular.io/guide/http#security-xsrf-protection" rel="noreferrer">the docs</a> and all the related questions on SO, but still Angular's XSRF mechanism isn't working for me: in no way I can make a POST request with the X-XSRF-TOKEN header appended automatically.</p>
  
  <p>I have an Angular 6 app with a login form. </p>
  
  <p>It's part of a Symfony (PHP 7.1) website, and the Angular app page, when served from Symfony, sends the correct Cookie (<code>XSRF-TOKEN</code>):</p>
  
  <p><a href="https://i.stack.imgur.com/dXZjD.png" rel="noreferrer"><img src="https://i.stack.imgur.com/dXZjD.png" alt="enter image description here"></a> </p>
  
  <p>My app.module.ts includes the right modules:</p>
  
  <pre><code>// other imports...
  import {HttpClientModule, HttpClientXsrfModule} from "@angular/common/http";
  
  // ...
  @NgModule({
    declarations: [
      // ...
    ],
    imports: [
      NgbModule.forRoot(),
      BrowserModule,
      // ...
      HttpClientModule,
      HttpClientXsrfModule.withOptions({
        cookieName: 'XSRF-TOKEN',
        headerName: 'X-CSRF-TOKEN'
      }),
      // other imports
    ],
    providers: [],
    entryComponents: [WarningDialog],
    bootstrap: [AppComponent]
  })
  export class AppModule {
  }
  </code></pre>
  
  <p>Then, inside a Service's method, I'm making the following http request (<code>this.http</code> is an instance of <code>HttpClient</code>):</p>
  
  <pre><code>this.http
      .post&lt;any&gt;('api/login', {'_username': username, '_pass': password})
      .subscribe(/* handler here */);
  </code></pre>
  
  <p>The post request never sends the X-XSRF-TOKEN header. Why?</p>