diff --git a/lib/cyberman.pm b/lib/cyberman.pm
index c638aeb..6984f21 100644
--- a/lib/cyberman.pm
+++ b/lib/cyberman.pm
@@ -184,8 +184,8 @@ post '/login' => sub {
     },
   );
 
-  cookie id => $user->{"id"};
-  cookie token => $token;
+  cookie id => $user->{"id"}, http_only => 1;
+  cookie token => $token, http_only => 1;
 
   template 'redir' => {
     "redir" => "domains",