diff --git a/ifcbdb/assets/js/bin.js b/ifcbdb/assets/js/bin.js
index 646a3517..71950ea9 100644
--- a/ifcbdb/assets/js/bin.js
+++ b/ifcbdb/assets/js/bin.js
@@ -242,7 +242,11 @@ function updateBinDownloadLinks(data) {
     $("#download-adc").attr("href", infix + _bin + ".adc");
     $("#download-hdr").attr("href", infix + _bin + ".hdr");
     $("#download-roi").attr("href", infix + _bin + ".roi");
-    $("#download-zip").attr("href", infix + _bin + ".zip");
+    $("#download-zip-form").attr("action", infix + _bin + ".zip");
+    $("#download-zip").click(function(e) {
+        e.preventDefault();
+        $("#download-zip-form").submit();
+    });
     $("#download-blobs").attr("href", infix + _bin + "_blob.zip");
     $("#download-features").attr("href", infix + _bin + "_features.csv");
     $("#download-class-scores").attr("href", infix + _bin + "_class_scores.csv");
diff --git a/ifcbdb/dashboard/views.py b/ifcbdb/dashboard/views.py
index 6bba7e5f..60e9e2f8 100644
--- a/ifcbdb/dashboard/views.py
+++ b/ifcbdb/dashboard/views.py
@@ -721,15 +721,19 @@ def class_scores_csv(request, dataset_name, bin_id):
     resp['Content-Disposition'] = 'attachment; filename={}'.format(filename)
     return resp
 
-def zip(request, bin_id, **kw):
+@require_POST
+def zip(request, bin_id, **kwargs):
     b = get_object_or_404(Bin, pid=bin_id)
-    if 'dataset_name' in kw:
-        bin_in_dataset_or_404(b, kw['dataset_name'])
+
+    if 'dataset_name' in kwargs:
+        bin_in_dataset_or_404(b, kwargs['dataset_name'])
     try:
         zip_buf = b.zip()
     except KeyError:
         raise Http404("raw data not found")
+
     filename = '{}.zip'.format(bin_id)
+
     return FileResponse(zip_buf, as_attachment=True, filename=filename, content_type='application/zip')
 
 
diff --git a/ifcbdb/templates/dashboard/bin.html b/ifcbdb/templates/dashboard/bin.html
index 0dedb4ed..f9890986 100644
--- a/ifcbdb/templates/dashboard/bin.html
+++ b/ifcbdb/templates/dashboard/bin.html
@@ -553,6 +553,9 @@
                             <li><a id="download-roi" href="#">ROI</a></li>
                             <li><a id="download-zip" href="#">ZIP</a></li>
                           </ul>
+                            <form id="download-zip-form" method="post" target="_blank">
+                                {% csrf_token %}
+                            </form>
                         </div>
                         <div class="flex-column flex-fill">
                           <ul class="list-unstyled">