diff --git a/basicauth.php b/basicauth.php
index <HASH>..<HASH> 100644
--- a/basicauth.php
+++ b/basicauth.php
@@ -91,11 +91,14 @@ class plgSystemBasicAuth extends JPlugin
         if (class_exists('Koowa'))
         {
             $manager = KObjectManager::getInstance();
+
             $request = $manager->getInstance()->getObject('com:koowa.dispatcher.request');
             $user    = $manager->getInstance()->getObject('user');
+            $token   = $user->getSession()->getToken();
 
             $request->setReferrer(JUri::root());
-            $request->getHeaders()->add(array('X-Xsrf-Token' => $user->getSession()->getToken()));
+            $request->getHeaders()->add(array('X-Xsrf-Token' => $token));
+            $request->getCookies()->add(array('csrf_token' => $token));
         }
 
         return true;
Make sure to set the CSRF cookie too on basic auth

If not set explicitely, command-line tools such as cURL will still throw an 'Invalid cookie token' error on CSRF authentication.