diff --git a/src/node/http.ts b/src/node/http.ts
index 027df102c..4dab2356a 100644
--- a/src/node/http.ts
+++ b/src/node/http.ts
@@ -330,6 +330,7 @@ export const getCookieOptions = (req: express.Request): express.CookieOptions =>
     domain: getCookieDomain(url.host, req.args["proxy-domain"]),
     path: normalize(url.pathname) || "/",
     sameSite: "lax",
+    httpOnly: true,
   }
 }