An easy way would be saving the remote IP together with browser signature inside the session, and rejecting any request not matching the stored info

The client's IP often changes in between requests. If the client's ISP is using a rotating proxy (which many big ISPs do), this is so common that it renders this approach unusable.

There is no 100% secure and browser-independent way to prevent a stolen cookie being replayed by the thief, impersonating the user.