What is 'session fixation' and what must the server do to prevent it at authentication time?

• A.Session fixation is when an attacker brute-forces session IDs until they find a valid one
• B.Session fixation is when an attacker pre-plants a known session ID on the victim (via URL parameter, subdomain cookie setting, or other means) before the victim logs in; if the server doesn't change the session ID upon authentication, the attacker's known ID becomes the victim's authenticated session. Prevention: regenerate the session ID immediately upon successful login, preserving any pre-login session data (like cart contents)
• C.Session fixation occurs when session cookies are sent without the Secure flag over HTTP
• D.Session fixation is an attack where multiple users share the same session ID due to server-side session store collision