Question: The question seems to be pretty easy, but I haven't found solution myself.

I have some folder, with 1 jpg-file inside it (foo bar.jpg) and this bat-file:

```
for /f %%f in ('dir /b /a:-d "*.jpg"') do echo "%%f"
pause

```

For some reason instead of something like this:

```
C:\Test>echo foo bar.jpg
foo bar.jpg

```

I see this:

```
C:\Test>echo "foo"
"foo"

```

Despite I already put `%%f` inside quotes.

I.e. command prompt doesn't understand the space in file name.

How to fix it?

(In my real code I will use `copy` instead of `echo`).

Answer: 
You can get the first CSRF token required for login using a `HEAD` request and looking at the cookies (no need to parse the page).

Also you can have your custom `cy.login()` return the token (asynchronously, so you need to use `.then()`) instead of having to call `cy.getCookie('csrftoken')` again if you need a token afterwards for POST requests and such:

```js
Cypress.Commands.add('login', (username, password) => {

  return cy.request({
    url: '/login/',
    method: 'HEAD' // cookies are in the HTTP headers, so HEAD suffices
  }).then(() => {

    cy.getCookie('sessionid').should('not.exist')
    cy.getCookie('csrftoken').its('value').then((token) => {
      let oldToken = token
      cy.request({
        url: '/login/',
        method: 'POST',
        form: true,
        followRedirect: false, // no need to retrieve the page after login
        body: {
          username: username,
          password: password,
          csrfmiddlewaretoken: token
        }
      }).then(() => {

        cy.getCookie('sessionid').should('exist')
        return cy.getCookie('csrftoken').its('value')

      })
    })
  })

})

```

Note: The token changes after login, therefore two `cy.getCookie('csrftoken')` calls.

Afterwards you can just use it in the following way in your tests (see <https://docs.djangoproject.com/en/dev/ref/csrf/> for why the header is needed):

```js
cy.login().then((csrfToken) => {

  cy.request({
    method: 'POST',
    url: '/api/baz/',
    body: { 'foo': 'bar' },
    headers: { 'X-CSRFToken': csrfToken }
  })

})

```
Cypress automatically sends the cookie named "csrftoken" with the request, but Django expects the csrf token to be called "csrfmiddlewaretoken". Therefore, I had to get the token and pass it by hand as follows:

```
    cy.getCookie('csrftoken')
    .then((csrftoken) => {
        cy.request({
            method: 'POST',
            url: your_url_here,
            // "form: true" is required here for the submitted information to be accessible via request.POST in Django (even though the docs make it sound like a bare 'POST' request can be made without the "form: true")
            form: true,
            body: {
                csrfmiddlewaretoken: csrftoken.value,
                testing: true,
                obj_model: 'Customer',
                field_name: 'name',
                field_value: 'Customer - Testing'
            }
        })
        .then((result) => {
            expect(result.body.success).to.equal(true)
        })
        .then(() => {
            //additional processing here if needed
        })
    })

```