The most important remediation action is to prevent the server from
accepting client supplied data as session tokens.

Additionally, the
client's session token should be changed at specific key stages of the
application flow, such as during authentication. This will ensure that
even if clients are able to set their own cookie, it will not persist
into an authenticated session.