What is session fixation and how can it be prevented?

In simple terms, session fixation is a type of attack where a malicious user tries to exploit the session handling of a web application by fixing the session ID before the victim logs in. To prevent it, the developer ensure that the code always generates a new session ID with a secure, random value after a user logs in. Do not accept session IDs from GET/POST requests or URL parameters, set secure and `HttpOnly` flags for cookies, and implement a short session expiration time. Also, consider using additional session validation checks, like potentially tying the session to the user's IP address or user-agent string.