What is a session fixation attack, and how does Spring Security prevent it by default?

It's an attack where an attacker gets the victim to authenticate under a session ID the attacker already knows (planted beforehand), letting the attacker reuse that same ID to appear as the authenticated victim. Spring Security defaults to changeSessionId(), issuing a fresh session ID immediately upon successful authentication, so any pre-login session ID an attacker might have set up becomes useless after login.