Question: The question seems to be pretty easy, but I haven't found solution myself.

I have some folder, with 1 jpg-file inside it (foo bar.jpg) and this bat-file:

```
for /f %%f in ('dir /b /a:-d "*.jpg"') do echo "%%f"
pause

```

For some reason instead of something like this:

```
C:\Test>echo foo bar.jpg
foo bar.jpg

```

I see this:

```
C:\Test>echo "foo"
"foo"

```

Despite I already put `%%f` inside quotes.

I.e. command prompt doesn't understand the space in file name.

How to fix it?

(In my real code I will use `copy` instead of `echo`).

Answer: 
To use Cypress to login programmatically with Django (i.e., without using the UI), the simplest solution is to change two words in the CSRF testing recipe that Cypress provides.

The two changes that I made in the below compared to the Cypress recipe at <https://github.com/cypress-io/cypress-example-recipes/blob/master/examples/logging-in__csrf-tokens/cypress/integration/logging-in-csrf-tokens-spec.js> are:

1. Changing `_csrf` to `csrfmiddlewaretoken`; and
2. Changing `$html.find("input[name=_csrf]").val()` to `$html.find("input[name=csrfmiddlewaretoken]").val()`

Recipe updated for Django 2.2:

```
// This recipe expands on the previous 'Logging in' examples
// and shows you how to use cy.request when your backend
// validates POSTs against a CSRF token
//
describe('Logging In - CSRF Tokens', function(){
  const username = 'cypress'
  const password = 'password123'

  Cypress.Commands.add('loginByCSRF', (csrfToken) => {
    cy.request({
        method: 'POST',
        url: '/login',
        failOnStatusCode: false, // dont fail so we can make assertions
        form: true, // we are submitting a regular form body
        body: {
          username,
          password,
          csrfmiddlewaretoken: csrfToken // insert this as part of form body
        }
      })
  })

  it('strategy #1: parse token from HTML', function(){
    cy.request('/login')
      .its('body')
      .then((body) => {
        const $html = Cypress.$(body)
        const csrf  = $html.find("input[name=csrfmiddlewaretoken]").val()

        cy.loginByCSRF(csrf)
          .then((resp) => {
            expect(resp.status).to.eq(200)
          })
      })
  })

```
You are correct, Cypress is not sending the token in the body because it is `undefined`, because of the way you are using `.get()` on the `input` to get the token.

You are using `.get()` as a *synchronous* call, but it's actually **async**. This is because Cypress will intelligently retry finding the DOM element, and that takes an indeterminate amount of time. This is a core concept of Cypress that enables built-in tests. The Cypress documentation details this better than I can, so check that out here: <https://docs.cypress.io/guides/core-concepts/introduction-to-cypress.html#Default-Assertions>

How you access a property on an element in the DOM should be put in a callback, in your case:

```
cy.get("input[name='csrfmiddlewaretoken']").then($input=>{
    const hidden_token = $input.val()
    cy.request({
        method: 'POST',
        form: true,
        url: login_url,
        // body: {'username': 'guest', 'password': 'password', 'csrfmiddlewaretoken': cy.getCookie('csrftoken').value}
        body: {'username': 'guest', 'password': 'password', 'csrfmiddlewaretoken': hidden_token}
    })
})

```

...

**Pro-tip: using Cypress's doc search will usually lend you what you need**
[![enter image description here](https://i.stack.imgur.com/1rc5c.png)](https://i.stack.imgur.com/1rc5c.png)