From the perspective of the site developer, you should use the following:
- Adopt SSL: use SSL sitewide.
- Set the
secure flag on all cookies. This will ensure that they are only sent over a SSL connection.
- Turn on HSTS.
This will ensure that session cookies are only accessible via SSL, and protect you from eavesdropping and man-in-the-middle attacks.
Search for SSL sitewide on this site to find many references on how to do this.
I wouldn't bother with checking the HTTP User Agent or the remote IP address. They don't add much security and they will break legitimate use in certain scenarios. Checking the SSL session ID (SSL session binding) would be OK from a security perspective, but may be a bit painful to configure and would not be a high priority for me: the other defenses are fine.
If your concern is cookie theft via XSS, the best defense is to use standard methods to avoid XSS bugs in your web application. See OWASP for many excellent resources (you'll want to use context-dependent output escaping).
You mention "session fixation" as a tag, but that's a very different threat. The defense against session fixation is to use a framework that is not vulnerable to session fixation. Most modern web application development frameworks should take care of this for you without requiring any additional work.
Follow secure web application development practices. OWASP has many excellent resources on this.
Read @Rook's advice carefully and follow it:
Checking the ip address will prevent people behind a load balancer
from accessing the site. Checking the user-agent provides no added
protection as this variable is attacker-controlled. The site needs to
be free form xss, csrf and click-jacking vulnerabilities.