Question: The question seems to be pretty easy, but I haven't found solution myself.

I have some folder, with 1 jpg-file inside it (foo bar.jpg) and this bat-file:

```
for /f %%f in ('dir /b /a:-d "*.jpg"') do echo "%%f"
pause

```

For some reason instead of something like this:

```
C:\Test>echo foo bar.jpg
foo bar.jpg

```

I see this:

```
C:\Test>echo "foo"
"foo"

```

Despite I already put `%%f` inside quotes.

I.e. command prompt doesn't understand the space in file name.

How to fix it?

(In my real code I will use `copy` instead of `echo`).

Answer: 
You can get the first CSRF token required for login using a `HEAD` request and looking at the cookies (no need to parse the page).

Also you can have your custom `cy.login()` return the token (asynchronously, so you need to use `.then()`) instead of having to call `cy.getCookie('csrftoken')` again if you need a token afterwards for POST requests and such:

```js
Cypress.Commands.add('login', (username, password) => {

  return cy.request({
    url: '/login/',
    method: 'HEAD' // cookies are in the HTTP headers, so HEAD suffices
  }).then(() => {

    cy.getCookie('sessionid').should('not.exist')
    cy.getCookie('csrftoken').its('value').then((token) => {
      let oldToken = token
      cy.request({
        url: '/login/',
        method: 'POST',
        form: true,
        followRedirect: false, // no need to retrieve the page after login
        body: {
          username: username,
          password: password,
          csrfmiddlewaretoken: token
        }
      }).then(() => {

        cy.getCookie('sessionid').should('exist')
        return cy.getCookie('csrftoken').its('value')

      })
    })
  })

})

```

Note: The token changes after login, therefore two `cy.getCookie('csrftoken')` calls.

Afterwards you can just use it in the following way in your tests (see <https://docs.djangoproject.com/en/dev/ref/csrf/> for why the header is needed):

```js
cy.login().then((csrfToken) => {

  cy.request({
    method: 'POST',
    url: '/api/baz/',
    body: { 'foo': 'bar' },
    headers: { 'X-CSRFToken': csrfToken }
  })

})

```
To use Cypress to login programmatically with Django (i.e., without using the UI), the simplest solution is to change two words in the CSRF testing recipe that Cypress provides.

The two changes that I made in the below compared to the Cypress recipe at <https://github.com/cypress-io/cypress-example-recipes/blob/master/examples/logging-in__csrf-tokens/cypress/integration/logging-in-csrf-tokens-spec.js> are:

1. Changing `_csrf` to `csrfmiddlewaretoken`; and
2. Changing `$html.find("input[name=_csrf]").val()` to `$html.find("input[name=csrfmiddlewaretoken]").val()`

Recipe updated for Django 2.2:

```
// This recipe expands on the previous 'Logging in' examples
// and shows you how to use cy.request when your backend
// validates POSTs against a CSRF token
//
describe('Logging In - CSRF Tokens', function(){
  const username = 'cypress'
  const password = 'password123'

  Cypress.Commands.add('loginByCSRF', (csrfToken) => {
    cy.request({
        method: 'POST',
        url: '/login',
        failOnStatusCode: false, // dont fail so we can make assertions
        form: true, // we are submitting a regular form body
        body: {
          username,
          password,
          csrfmiddlewaretoken: csrfToken // insert this as part of form body
        }
      })
  })

  it('strategy #1: parse token from HTML', function(){
    cy.request('/login')
      .its('body')
      .then((body) => {
        const $html = Cypress.$(body)
        const csrf  = $html.find("input[name=csrfmiddlewaretoken]").val()

        cy.loginByCSRF(csrf)
          .then((resp) => {
            expect(resp.status).to.eq(200)
          })
      })
  })

```