解决慢性HTTP服务攻击问题时web.xml出现报错

为了解决慢性HTTP服务攻击，我在web.xml中加入了下面这段代码，但是cookie-config这行代码前面报了错，提示的是“cvc-complex-type.2.4.d: Invalid content was found starting with element 'cookie-config'. No child element is expected at this point. ”，请问大神帮忙看看这个是哪里的问题

<session-config>
        <session-timeout>30</session-timeout>
        <cookie-config>
           <secure>true</secure>
           <http-only>true</http-only>
       </cookie-config>
 </session-config>