The application is built with CodeIgniter 3.2. With in a Big corp. there are several users accounts on same public IP. Now upon implementing the WAF (Web Application Firewall), weird behavior happened.

When the users logged into their own accounts but accessed another user’s profile directly. Few users were on their mobile devices using different data networks.

I have no clue why this has started after waf added. Is there any settings with sessions? why the sessions are jumping up. Below mentioned are the sessions settings in config file.
Session are stored in DB.

$config['sess_driver'] = 'database';

$config['sess_cookie_name'] = 'ciapp_session';

$config['sess_expiration'] = 32400; //7200;

$config['sess_save_path'] = 'ci_sessions';

$config['sess_match_ip'] = FALSE;

$config['sess_time_to_update'] =60; // 300;

$config['sess_regenerate_destroy'] =  TRUE;


$config['sess_match_useragent'] = TRUE;

$config['cookie_prefix']    = '';

$config['cookie_domain']    = '';

$config['cookie_path']      = '/';

$config['cookie_secure']    = FALSE; //setting this to TRUE leading me to 429 error on user login/logout

$config['cookie_httponly']  = TRUE;