diff --git a/recipe-server/normandy/settings.py b/recipe-server/normandy/settings.py
index <HASH>..<HASH> 100644
--- a/recipe-server/normandy/settings.py
+++ b/recipe-server/normandy/settings.py
@@ -280,7 +280,7 @@ class Base(Core):
     SECURE_PROXY_SSL_HEADER = values.TupleValue()
     SECURE_HSTS_SECONDS = values.IntegerValue(3600)
     SECURE_HSTS_INCLUDE_SUBDOMAINS = values.BooleanValue(True)
-    CSRF_COOKIE_HTTPONLY = values.BooleanValue(True)
+    CSRF_COOKIE_HTTPONLY = values.BooleanValue(False)
     CSRF_COOKIE_SECURE = values.BooleanValue(True)
     SECURE_SSL_REDIRECT = values.BooleanValue(True)
     SECURE_REDIRECT_EXEMPT = values.ListValue([])
Set CSRF_COOKIE_HTTPONLY to False by default