New posts in Session Fixation

Session Fixation: A token and an id

Can advertisements read cookies of the website it is on?

Can't a user change his session information to impersonate others?

Do you need to encrypt session data?