fingerprinting is used for anything but security, so do not use it for such a purpose.
Since you are using openresty, you can in fact add security to your session handler lua-resty-session has several different options as to where store the session data.
When you read pluggable-storage-adapters you see a table of storage adapters.
For your purpose I would suggest you implement one with Extra Security
and implement HMAC.
This will make sure that the session data stays on the server, and that the client only has a HMAC token they can not alter without losing the session.
For additional protection you can add a little code to the authentication Lua to make sure the session is invalidated when the ip source changes.
I hope this answers your Question.
-- Including a comment I made to this awnser.
fingerprinting can be used to enhance the certainty of a specific user, it is however unsuited to replace other means of identification.
(see it like an ID check at a customs officer, your passport Identifies you, its number (and the check done by the automated systems) validates the document is real. and the image of your picture can be used to validate yourself to the officer. So in total while there is only 1 primary carrier of authenticity (the passport) there are many checks done to validate it.
Each check adds to the certainty that the person is who he/she claims to be.
and as part of a authentication scheme you can add the fingerprint as additional information to proof identity. But it should never replace other proofs as its to generic, and to easily to forge or extract through other means.