How can it be? Set-Cookie:dancer.session=483720827403356057308938541604196340; path=/; expires=Sat, 06-Jul-2013 06:27:52 GMT; HttpOnly Set-Cookie:dancer.session=483720827403356057308938541604196340; path=/; expires=Sat, 06-Jul-2013 06:27:52 GMT; HttpOnly The route: get "/mfile/:id" => sub { return send_file( sprintf("file/%d", $id), content_type => "image/png", system_path => 1 ); };