Question: The question seems to be pretty easy, but I haven't found solution myself.

I have some folder, with 1 jpg-file inside it (foo bar.jpg) and this bat-file:

```
for /f %%f in ('dir /b /a:-d "*.jpg"') do echo "%%f"
pause

```

For some reason instead of something like this:

```
C:\Test>echo foo bar.jpg
foo bar.jpg

```

I see this:

```
C:\Test>echo "foo"
"foo"

```

Despite I already put `%%f` inside quotes.

I.e. command prompt doesn't understand the space in file name.

How to fix it?

(In my real code I will use `copy` instead of `echo`).

Answer: 
You can get the first CSRF token required for login using a `HEAD` request and looking at the cookies (no need to parse the page).

Also you can have your custom `cy.login()` return the token (asynchronously, so you need to use `.then()`) instead of having to call `cy.getCookie('csrftoken')` again if you need a token afterwards for POST requests and such:

```js
Cypress.Commands.add('login', (username, password) => {

  return cy.request({
    url: '/login/',
    method: 'HEAD' // cookies are in the HTTP headers, so HEAD suffices
  }).then(() => {

    cy.getCookie('sessionid').should('not.exist')
    cy.getCookie('csrftoken').its('value').then((token) => {
      let oldToken = token
      cy.request({
        url: '/login/',
        method: 'POST',
        form: true,
        followRedirect: false, // no need to retrieve the page after login
        body: {
          username: username,
          password: password,
          csrfmiddlewaretoken: token
        }
      }).then(() => {

        cy.getCookie('sessionid').should('exist')
        return cy.getCookie('csrftoken').its('value')

      })
    })
  })

})

```

Note: The token changes after login, therefore two `cy.getCookie('csrftoken')` calls.

Afterwards you can just use it in the following way in your tests (see <https://docs.djangoproject.com/en/dev/ref/csrf/> for why the header is needed):

```js
cy.login().then((csrfToken) => {

  cy.request({
    method: 'POST',
    url: '/api/baz/',
    body: { 'foo': 'bar' },
    headers: { 'X-CSRFToken': csrfToken }
  })

})

```
According to the documentation

> 
> In addition, for HTTPS requests, strict referer checking is done by CsrfViewMiddleware. This means that even if a subdomain can set or modify cookies on your domain, it can’t force a user to post to your application since that request won’t come from your own exact domain.
> 
> 
> 

<https://docs.djangoproject.com/en/3.0/ref/csrf/#how-it-works>

Thus, if you're testing a site using HTTPS request, you might have to explicitly set your `Referer` header. 

This solved it for me:

```
cy.request({ url: '/accounts/login/', method: 'HEAD' });
cy.getCookie('csrftoken').then(v => {
  cy.request({
    method: 'POST',
    form: true,
    url: '/accounts/login/',
    headers: {
      Referer: `${Cypress.config('baseUrl')}/accounts/login/`
    },
    body: {
      csrfmiddlewaretoken: v.value,
      login: Cypress.env('agentUsername'),
      password: Cypress.env('agentPassword')
    }
  });
});

```