Fixation: controlling the identifier before login happens
Session fixation works by an attacker establishing a known session identifier and getting the victim to authenticate while using it — often through a crafted link the victim clicks. Once the victim logs in, the identifier the attacker already knows becomes an authenticated session, without the attacker ever needing to intercept or steal anything afterward. The defense is specific and effective: issue a fresh session identifier at the exact moment authentication succeeds, rather than continuing to use whatever identifier happened to already be active.
Hijacking: obtaining the identifier after login has already happened
Session hijacking targets an already-established, legitimate session identifier — intercepted over an unencrypted connection, stolen through a scripting vulnerability, or leaked in a log — and uses it to act as the session's original owner, without needing that person's actual credentials at all. Because the session identifier itself is what gets checked on each request, holding it is functionally equivalent to being that logged-in user.
Defending against hijacking focuses on reducing the ways an identifier could leak in the first place, and on limiting the damage when one does anyway — encrypting it in transit, keeping its lifetime short, and tying it to properties of the original request that a hijacker's traffic is unlikely to match exactly.