Question: The question seems to be pretty easy, but I haven't found solution myself.

I have some folder, with 1 jpg-file inside it (foo bar.jpg) and this bat-file:

```
for /f %%f in ('dir /b /a:-d "*.jpg"') do echo "%%f"
pause

```

For some reason instead of something like this:

```
C:\Test>echo foo bar.jpg
foo bar.jpg

```

I see this:

```
C:\Test>echo "foo"
"foo"

```

Despite I already put `%%f` inside quotes.

I.e. command prompt doesn't understand the space in file name.

How to fix it?

(In my real code I will use `copy` instead of `echo`).

Answer: 
According to the documentation

> 
> In addition, for HTTPS requests, strict referer checking is done by CsrfViewMiddleware. This means that even if a subdomain can set or modify cookies on your domain, it can’t force a user to post to your application since that request won’t come from your own exact domain.
> 
> 
> 

<https://docs.djangoproject.com/en/3.0/ref/csrf/#how-it-works>

Thus, if you're testing a site using HTTPS request, you might have to explicitly set your `Referer` header. 

This solved it for me:

```
cy.request({ url: '/accounts/login/', method: 'HEAD' });
cy.getCookie('csrftoken').then(v => {
  cy.request({
    method: 'POST',
    form: true,
    url: '/accounts/login/',
    headers: {
      Referer: `${Cypress.config('baseUrl')}/accounts/login/`
    },
    body: {
      csrfmiddlewaretoken: v.value,
      login: Cypress.env('agentUsername'),
      password: Cypress.env('agentPassword')
    }
  });
});

```
You are correct, Cypress is not sending the token in the body because it is `undefined`, because of the way you are using `.get()` on the `input` to get the token.

You are using `.get()` as a *synchronous* call, but it's actually **async**. This is because Cypress will intelligently retry finding the DOM element, and that takes an indeterminate amount of time. This is a core concept of Cypress that enables built-in tests. The Cypress documentation details this better than I can, so check that out here: <https://docs.cypress.io/guides/core-concepts/introduction-to-cypress.html#Default-Assertions>

How you access a property on an element in the DOM should be put in a callback, in your case:

```
cy.get("input[name='csrfmiddlewaretoken']").then($input=>{
    const hidden_token = $input.val()
    cy.request({
        method: 'POST',
        form: true,
        url: login_url,
        // body: {'username': 'guest', 'password': 'password', 'csrfmiddlewaretoken': cy.getCookie('csrftoken').value}
        body: {'username': 'guest', 'password': 'password', 'csrfmiddlewaretoken': hidden_token}
    })
})

```

...

**Pro-tip: using Cypress's doc search will usually lend you what you need**
[![enter image description here](https://i.stack.imgur.com/1rc5c.png)](https://i.stack.imgur.com/1rc5c.png)