Repository: angular
Issue: HttpClientXsrfModule breaks compatibility with HttpModule by not handling GET requests
Labels: feature,freq3: high,area: common/http,state: needs eng input,type: use-case,design complexity: low-hanging,P4,feature: under consideration

<!--
PLEASE HELP US PROCESS GITHUB ISSUES FASTER BY PROVIDING THE FOLLOWING INFORMATION.

ISSUES MISSING IMPORTANT INFORMATION MAY BE CLOSED WITHOUT INVESTIGATION.
-->

## I'm submitting a...
<!-- Check one of the following options with "x" -->
<pre><code>
[x] Regression (a behavior that used to work and stopped working in a new release)
[ ] Bug report  <!-- Please search GitHub for a similar issue or PR before submitting -->
[ ] Feature request
[ ] Documentation issue or request
[ ] Support request => Please do not submit support request here, instead see https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question
</code></pre>

## Current behavior
<!-- Describe how the issue manifests. -->

In `HttpModule` you could use XSRF support for GET requests. It added the XSRF header for all requests including GET requests

But `HttpClientModule` does not send the XSRF header for GET requests.

I understand why it's implemented this way, but in corporate world you might want to protect everything as well. This is not the point though.

The point is that this is an undocumented breaking change when moving from `HttpModule` to `HttpClientModule`, that could cost a lot of debugging time if you had code depending on old behaviour.

You can only tell the problem by looking at source code

https://github.com/angular/angular/blob/master/packages/common/http/src/xsrf.ts#L81-L82

    if (req.method === 'GET' || req.method === 'HEAD' || lcUrl.startsWith('http://') ||
        lcUrl.startsWith('https://')) {

Which I only did by accident after long debugging and then googling and seeing https://github.com/angular/angular/issues/18859#issuecomment-333844607

## Expected behavior
<!-- Describe what the desired behavior would be. -->

Either:

- Document the different behaviour
- Allow overriding it with options
- Or just keep it as before

## Minimal reproduction of the problem with instructions
<!--
For bug reports please provide the *STEPS TO REPRODUCE* and if possible a *MINIMAL DEMO* of the problem via
https://plnkr.co or similar (you can use this template as a starting point: http://plnkr.co/edit/tpl:AvJOMERrnz94ekVua0u5).
-->

For a server that supports XSRF, create a GET Api call with `HttpModule`.

Observe the call working fine.

Change `HttpModule` to ``HttpClientModule` and ``HttpClientXsrfModule`.

See the call fail.

## What is the motivation / use case for changing the behavior?
<!-- Describe the motivation or the concrete use case. -->

Because it was working before and now it breaks.

## Environment

<pre><code>
Angular version: 4.3+
<!-- Check whether this is still an issue in the most recent Angular version -->

Browser:
- [ ] Chrome (desktop) version XX
- [ ] Chrome (Android) version XX
- [ ] Chrome (iOS) version XX
- [ ] Firefox version XX
- [ ] Safari (desktop) version XX
- [ ] Safari (iOS) version XX
- [ ] IE version XX
- [ ] Edge version XX
 
For Tooling issues:
- Node version: XX  <!-- run `node --version` -->
- Platform:  <!-- Mac, Linux, Windows -->

Others:
<!-- Anything else relevant?  Operating system version, IDE, package manager, HTTP server, ... -->
</code></pre>