What is missing or needs to be updated?

The article incorrectly uses the terms "False Negative" and "False Positive" when describing the limitations of the solutions aimed at mitigating cookie theft. This is confusing and factually wrong.

Link to section: https://cheatsheetseries.owasp.org/cheatsheets/Cookie_Theft_Mitigation_Cheat_Sheet.html#cookie-theft-mitigation

Specifically, these two sentences are problematic:

In other words, it is not possible to say with certainty that it is an attack just because the IP-Geo has changed. This means that there are False Negatives (it seems to be an attack, but it is not) in this detection method.

"False Negatives" is wrong here. It should write False Positives.

At the same time, even if the IP-Geo does not change, there is also the possibility that the attacker is attacking from within the same country. This means that this detection method has a False positives (it seems not to be an attack, but it is).

"False positives" should be False Negatives.

The later sentence:

However, as mentioned earlier, monitoring sessions has the potential for false positives, so if you have to re-authenticate too often, it will be a poor experience for the user.

does use "false positive" correctly, which further adds to the potential for confusion.

Reasoning:

This correction aligns the text with the standard definitions of False Positives and False Negatives in the context of security detection:

A legitimate IP change (e.g. the user travelling) incorrectly flagged as an attack is a False Positive.

An attacker's activity not flagged correctly as an attack is a False Negative.

written by me, formatted to markdown using AI