diff --git a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/util/WebUtils.java b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/util/WebUtils.java
index a1da71a..06637bd 100644
--- a/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/util/WebUtils.java
+++ b/services/idp-core/src/main/java/org/apache/cxf/fediz/service/idp/util/WebUtils.java
@@ -191,6 +191,7 @@
         Cookie cookie = new Cookie(cookieName, cookieValue);
         cookie.setSecure(true);
         cookie.setMaxAge(-1);
+        cookie.setHttpOnly(true);
         cookie.setPath("/fediz-idp");
         httpServletResponse.addCookie(cookie);
     }