<?php
namespace wcf\acp\action;
use wcf\action\AbstractSecureAction;
use wcf\system\request\LinkHandler;
use wcf\system\WCF;
use wcf\util\HeaderUtil;

/**
 * Does the user logout in the admin control panel.
 * 
 * @author	Tim Duesterhus, Marcel Werk
 * @copyright	2001-2021 WoltLab GmbH
 * @license	GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
 * @package	WoltLabSuite\Core\Acp\Action
 */
class LogoutAction extends AbstractSecureAction {
	/**
	 * @inheritDoc
	 */
	public $loginRequired = true;
	
	/**
	 * @inheritDoc
	 */
	public function execute() {
		parent::execute();
		
		// do logout
		WCF::getSession()->clearReauthentication();
		
		$this->executed();
		
		HeaderUtil::redirect(LinkHandler::getInstance()->getLink(null, [
			'forceFrontend' => true,
		]));
		exit;
	}
}

<?php
namespace wcf\acp\action;
use wcf\action\AbstractSecureAction;
use wcf\system\request\LinkHandler;
use wcf\system\WCF;
use wcf\util\HeaderUtil;

/**
 * Does the user logout in the admin control panel.
 * 
 * @author	Marcel Werk
 * @copyright	2001-2019 WoltLab GmbH
 * @license	GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
 * @package	WoltLabSuite\Core\Acp\Action
 */
class LogoutAction extends AbstractSecureAction {
	/**
	 * @inheritDoc
	 */
	public $loginRequired = true;
	
	/**
	 * @inheritDoc
	 */
	public function execute() {
		parent::execute();
		
		// do logout
		WCF::getSession()->delete();
		
		$this->executed();
		
		// forward to index page
		// warning: if doLogout() writes a cookie this is buggy in MS IIS
		HeaderUtil::redirect(LinkHandler::getInstance()->getLink('Login'));
		exit;
	}
}

--- 
+++ 
@@ -8,8 +8,8 @@
 /**
  * Does the user logout in the admin control panel.
  * 
- * @author	Marcel Werk
- * @copyright	2001-2019 WoltLab GmbH
+ * @author	Tim Duesterhus, Marcel Werk
+ * @copyright	2001-2021 WoltLab GmbH
  * @license	GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
  * @package	WoltLabSuite\Core\Acp\Action
  */
@@ -26,13 +26,13 @@
 		parent::execute();
 		
 		// do logout
-		WCF::getSession()->delete();
+		WCF::getSession()->clearReauthentication();
 		
 		$this->executed();
 		
-		// forward to index page
-		// warning: if doLogout() writes a cookie this is buggy in MS IIS
-		HeaderUtil::redirect(LinkHandler::getInstance()->getLink('Login'));
+		HeaderUtil::redirect(LinkHandler::getInstance()->getLink(null, [
+			'forceFrontend' => true,
+		]));
 		exit;
 	}
 }
Clear reauthentication in ACP logout

This will kill access to the ACP without invalidating the frontend session. By
redirecting to the frontend the user can easily perform a full logout.
