What are the defensive measures against session hijacking attacks

Question

I'm developing a web application where session management is critical, and I’m concerned about the risk of session hijacking attacks. I understand that measures like using HTTPS, setting secure and HTTPOnly flags for cookies, and regenerating session IDs periodically can help, but I'm looking for a comprehensive list of defenses. Specifically, I’d appreciate insights on:

• Best practices for session token generation and lifecycle management.
• Additional server-side and network-level safeguards.
• Techniques to detect if a session has been compromised. Any detailed advice or real-world examples would help me strengthen my application's security posture.