Index: src/wp-includes/pluggable.php
===================================================================
--- src/wp-includes/pluggable.php	(revision 25042)
+++ src/wp-includes/pluggable.php	(working copy)
@@ -494,6 +494,7 @@
  * @since 2.5.0
  */
 function wp_logout() {
+	wp_destroy_current_session();
 	wp_clear_auth_cookie();
 	do_action('wp_logout');
 }
@@ -543,8 +544,8 @@
 
 	$pass_frag = substr($user->user_pass, 8, 4);
 
-	$key = wp_hash($username . $pass_frag . '|' . $expiration, $scheme);
-	$hash = hash_hmac('md5', $username . '|' . $expiration, $key);
+	$key = wp_hash($username . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme);
+	$hash = hash_hmac('md5', $username . '|' . $expiration . '|' . $token, $key);
 
 	if ( $hmac != $hash ) {
 		do_action('auth_cookie_bad_hash', $cookie_elements);
@@ -551,6 +552,11 @@
 		return false;
 	}
 
+	if ( ! wp_verify_session_token( $user->ID, $token ) ) {
+		do_action( 'auth_cookie_bad_session_token', $cookie_elements );
+		return false;
+	}
+
 	if ( $expiration < time() ) // AJAX/POST grace period set above
 		$GLOBALS['login_grace_period'] = 1;
 
@@ -571,17 +577,23 @@
  * @param int $user_id User ID
  * @param int $expiration Cookie expiration in seconds
  * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
+ * @param string $token User's session token to use for this cookie
  * @return string Authentication cookie contents
  */
-function wp_generate_auth_cookie($user_id, $expiration, $scheme = 'auth') {
-	$user = get_userdata($user_id);
+function wp_generate_auth_cookie($user_id, $expiration, $scheme = 'auth', $token = '') {
+	$user = new WP_User($user_id);
+	if ( ! $user->exists() )
+		return '';
 
+	if (empty($token))
+		$token = wp_create_session_token( $user_id, $expiration );
+
 	$pass_frag = substr($user->user_pass, 8, 4);
 
-	$key = wp_hash($user->user_login . $pass_frag . '|' . $expiration, $scheme);
-	$hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
+	$key = wp_hash($user->user_login . '|' . $pass_frag . '|' . $expiration . '|' . $token, $scheme);
+	$hash = hash_hmac('md5', $user->user_login . '|' . $expiration . '|' . $token, $key);
 
-	$cookie = $user->user_login . '|' . $expiration . '|' . $hash;
+	$cookie = $user->user_login . '|' . $expiration . '|' . $token . '|' . $hash;
 
 	return apply_filters('auth_cookie', $cookie, $user_id, $expiration, $scheme);
 }
@@ -625,12 +637,12 @@
 	}
 
 	$cookie_elements = explode('|', $cookie);
-	if ( count($cookie_elements) != 3 )
+	if ( count($cookie_elements) != 4 )
 		return false;
 
-	list($username, $expiration, $hmac) = $cookie_elements;
+	list($username, $expiration, $token, $hmac) = $cookie_elements;
 
-	return compact('username', 'expiration', 'hmac', 'scheme');
+	return compact('username', 'expiration', 'token', 'hmac', 'scheme');
 }
 endif;
 
@@ -646,6 +658,7 @@
  *
  * @param int $user_id User ID
  * @param bool $remember Whether to remember the user
+ * @param mixed $secure Whether the admin cookies should only be sent over HTTPS (defaults to is_ssl())
  */
 function wp_set_auth_cookie($user_id, $remember = false, $secure = '') {
 	if ( $remember ) {
@@ -669,9 +682,11 @@
 		$scheme = 'auth';
 	}
 
-	$auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme);
-	$logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in');
+	$token = wp_create_session_token( $user_id, $expiration );
 
+	$auth_cookie = wp_generate_auth_cookie( $user_id, $expiration, $scheme, $token );
+	$logged_in_cookie = wp_generate_auth_cookie( $user_id, $expiration, 'logged_in', $token );
+
 	do_action('set_auth_cookie', $auth_cookie, $expire, $expiration, $user_id, $scheme);
 	do_action('set_logged_in_cookie', $logged_in_cookie, $expire, $expiration, $user_id, 'logged_in');
 
@@ -1258,14 +1273,14 @@
 	$uid = (int) $user->ID;
 	if ( ! $uid )
 		$uid = apply_filters( 'nonce_user_logged_out', $uid, $action );
-
+	$token = wp_get_session_token();
 	$i = wp_nonce_tick();
 
 	// Nonce generated 0-12 hours ago
-	if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce )
+	if ( substr(wp_hash($i . '|' . $action . '|' . $uid . '|' . $token, 'nonce'), -12, 10) === $nonce )
 		return 1;
 	// Nonce generated 12-24 hours ago
-	if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce )
+	if ( substr(wp_hash(($i - 1) . '|' . $action . '|' . $uid . '|' . $token, 'nonce'), -12, 10) === $nonce )
 		return 2;
 	// Invalid nonce
 	return false;
@@ -1286,10 +1301,10 @@
 	$uid = (int) $user->ID;
 	if ( ! $uid )
 		$uid = apply_filters( 'nonce_user_logged_out', $uid, $action );
-
+	$token = wp_get_session_token();
 	$i = wp_nonce_tick();
 
-	return substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10);
+	return substr(wp_hash($i . '|' . $action . '|' . $uid . '|' . $token, 'nonce'), -12, 10);
 }
 endif;
 
Index: src/wp-includes/user.php
===================================================================
--- src/wp-includes/user.php	(revision 25042)
+++ src/wp-includes/user.php	(working copy)
@@ -1550,3 +1550,94 @@
 	}
 	return apply_filters( 'user_contactmethods', $user_contactmethods, $user );
 }
+
+/**
+ * Generate a cookie session identification token.
+ *
+ * A session identification token is a long, random string. It is used to
+ * link a cookie to an expiration time and to ensure that cookies become
+ * invalidated upon logout. This function generates a token and stores it
+ * as user meta with the associated expiration time.
+ *
+ * Will also remove any expired tokens from the database.
+ *
+ * @since 3.7.0
+ *
+ * @param int $user_id User to create a token for.
+ * @param int $expiration Session expiration timestamp.
+ * @return string Session identification token.
+ */
+function wp_create_session_token( $user_id, $expiration ) {
+	$sessions = get_user_meta( $user_id, 'session_tokens', true );
+	if ( ! $sessions )
+		$sessions = array();
+	// Expire old sessions
+	$time = time();
+	foreach ( $sessions as $v => $e ) {
+		if ( $e < $time )
+			unset( $sessions[ $v ] );
+	}
+
+	$token = wp_generate_password( 40, false, false );
+	$verifier = hash( 'sha256', $token );
+	$sessions[$verifier] = $expiration;
+
+	update_user_meta( $user_id, 'session_tokens', $sessions );
+
+	return $token;
+}
+
+/**
+ * Validate a user's session token as authentic.
+ *
+ * Checks that the given token is present in the database and hasn't expired.
+ *
+ * @since 3.7.0
+ *
+ * @param int $user_id User to verify against.
+ * @param string $token Token to verify.
+ * @return bool Whether the token is valid for the given user.
+ */
+function wp_verify_session_token( $user_id, $token ) {
+	$sessions = get_user_meta( $user_id, 'session_tokens', true );
+	$verifier = hash( 'sha256', $token );
+	return isset( $sessions[$verifier] ) && $sessions[$verifier] >= time();
+}
+
+/**
+ * Remove the current session token from the database.
+ *
+ * Will also remove any expired tokens from the database.
+ *
+ * @since 3.7.0
+ */
+function wp_destroy_current_session() {
+	$token = wp_get_session_token();
+	if ( ! empty( $token ) ) {
+		$user_id = get_current_user_id();
+		$verifier = hash( 'sha256', $token );
+		$sessions = get_user_meta( $user_id, 'session_tokens', true );
+		unset( $sessions[$verifier] );
+
+		// Expire old sessions
+		$time = time();
+		foreach ( $sessions as $v => $e ) {
+			if ( $e < $time )
+				unset( $sessions[ $v ] );
+		}
+
+		update_user_meta( $user_id, 'session_tokens', $sessions );
+	}
+}
+
+/**
+ * Retrieve the current session token from the logged_in cookie.
+ *
+ * @since 3.7.0
+ *
+ * @return string
+ */
+function wp_get_session_token() {
+	$cookie = wp_parse_auth_cookie( '', 'logged_in' );
+	return ! empty( $cookie['token'] ) ? $cookie['token'] : '';
+}