Websites has various methods implemented to tell browser to always use HTTPS - HSTS header, server redirec to HTTPS, CSP policy. However, the first time a user visits the site it can be over palin HTTP. Only after then browser knows that the site should be over TLS will it always use it.
But what if an attack has access to traffic during the first visit, and is acting like man in middle?
For instance, the attacker could perform a session fixation attack. The attacker visits the site, and gets assigned a cookie with a session id. When the user visits the site over HTTP, the attacker responds on behalf of the server and assigns his cookie to the user. Then the attacker lets all traffic through onwards. The user makes requests with the attacker's session id, give away information and so on. Now the attacker can make requests with that id and get the user's information.
What can be done to stop this kind of attack?