Session hijacking problem

I have a question about ci_session. We build our own login system with a session. We found out that if you copy and paste the ci_session and put it in an other browser, the user is logged in without seeing the login screen. I keep stuff as default as possible in CodeIgniter 4. But changed $sessionMatchIP to true in app/Config/App.php:

PHP Code:

public $sessionMatchIP = true; 


My question is, is there a downside of having this setting on true? It feels much safer. Are there more settings to change to prevent session hijacking?
Thanks in advance.

---

I found out that the location of this setting has been changed since v4.4.0, but the question remains the same.

It's safer, but it's bad if the IP is dynamic (for example, a mobile operator).

Behind a Proxy Server.

What did you Try? What did you Get? What did you Expect?

Joined CodeIgniter Community 2009.  ( Skype: insitfx )

Yes, it may be out of prox or set time session generation here is where also I hijack your system if no one cares enough

Code:

session.driver = 'CodeIgniter\Session\Handlers\FileHandler'
  session.cookieName = 'ci_session'
  session.expiration = 7200
  session.savePath = writable/session
  session.matchIP = true
  session.timeToUpdate = 300 to /*1*/ look here
  session.regenerateDestroy = true

PHP Code:

public bool $matchIP = false;

    /**
    * --------------------------------------------------------------------------
    * Session Time to Update
    * --------------------------------------------------------------------------
    *
    * How many seconds between CI regenerating the session ID.
    */
    public int $timeToUpdate = 300; /* to 1*/ look here

 /**
     * --------------------------------------------------------------------------
     * Session Regenerate Destroy
     * --------------------------------------------------------------------------
     *
     * Whether to destroy session data associated with the old session ID
     * when auto-regenerating the session ID. When set to FALSE, the data
     * will be later deleted by the garbage collector.
     */
    public bool $regenerateDestroy = true; 


Codeigniter First, Codeigniter Then You!!

yekrinaDigitals

Thank you for your responses. I also did what luckmoshy said, but kept timeToUpdate at 100.