An attacker plants a session id they know in the victim's browser before login, and the app keeps using that same id after the victim logs in. What is the main fix?

This attack is called session fixation. The fix is to give the user a fresh session id when login succeeds. Then the id the attacker planted becomes worthless. Do the same on every privilege change, for example when a user becomes an admin. "Encrypt the session id cookie" does not help. The attacker doesn't need to read the id, because they chose it.