Mobile app token refresh fails in warehouse management causing picking operation lockouts

ERP Infor CloudSuite
, , , , , , , ,
1

We’re experiencing critical OAuth2 token refresh failures in our warehouse mobile app running on ICS 2023.1. Pickers lose authentication mid-session during picking operations, forcing them to re-login multiple times per shift.

The token refresh mechanism fails after the initial access token expires (typically 60 minutes). Looking at the mobile app logs, we see CORS preflight errors when the refresh token endpoint is called:


Access to XMLHttpRequest blocked by CORS policy
Response to preflight request doesn't pass access control check
No 'Access-Control-Allow-Origin' header present

Our token expiration is set to 3600 seconds with refresh tokens valid for 7 days. The mobile authentication lifecycle seems broken - users authenticate successfully via OAuth2, work fine initially, but token rotation fails consistently. This impacts 45+ warehouse staff daily. Has anyone dealt with CORS configuration issues for mobile OAuth2 flows or token refresh failures in warehouse management?

system 2

Here’s the complete solution based on your OAuth2 refresh token flow issues:

1. CORS Configuration for Mobile Clients: Navigate to ICS Security Console > API Gateway > CORS Settings. Add your mobile app origin:


Allowed Origins: app://warehouse.infor.mobile
Allowed Methods: GET, POST, OPTIONS
Allowed Headers: Authorization, Content-Type
Expose Headers: X-Token-Expiry

For the OAuth2 refresh endpoint specifically, ensure it’s included in the CORS-enabled paths. Mobile apps don’t send traditional Origin headers, so you may need to configure the authorization server to accept requests with custom app schemes.

2. Token Expiration and Rotation Policies: Your current 60-minute access token with 7-day refresh token is reasonable, but implement proactive refresh. Modify your mobile app’s token management:

// Refresh 10 minutes before expiry
if (tokenExpiresIn < 600) {
  await refreshAccessToken();
}

Configure token rotation with overlap: In ICS Security Settings > OAuth2 Configuration, enable “Allow Refresh Token Reuse” with a 5-minute grace period. This prevents authentication gaps during the refresh process.

3. Mobile App Authentication Lifecycle: Implement a proper token refresh interceptor in your mobile app that:

  • Catches 401 Unauthorized responses
  • Automatically calls the refresh token endpoint
  • Retries the original request with the new access token
  • Handles refresh token expiration by prompting re-authentication

The key issue is that your CORS policy isn’t allowing the preflight OPTIONS request from the mobile app. Once you add the mobile app origin and ensure the refresh endpoint is CORS-enabled, the token refresh flow should work seamlessly.

4. Verification Steps:

  • Test the OPTIONS request to your refresh endpoint using curl or Postman with mobile app headers
  • Monitor OAuth2 server logs during token refresh to see if requests are being blocked
  • Implement logging in your mobile app to track token refresh attempts and failures
  • Set up alerts for repeated token refresh failures to catch issues early

For warehouse operations, also consider implementing offline token caching with secure storage so pickers can continue working briefly during network interruptions. The mobile authentication lifecycle should handle network transitions gracefully without forcing re-login.

This configuration should eliminate the CORS errors and ensure smooth token rotation throughout picker shifts.

This draft is based on general Infor CloudSuite knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.

3

I’ve seen similar CORS issues with mobile OAuth2 implementations. The preflight OPTIONS request is likely being blocked because your API gateway or reverse proxy isn’t configured to handle cross-origin requests from mobile apps. Check if your CORS policy includes the refresh token endpoint specifically - sometimes it’s only configured for the initial authentication endpoint. Also verify that your mobile app is sending the correct Origin header.

4

This is a common mobile authentication lifecycle issue. Your CORS configuration needs to whitelist the mobile app’s origin, but more importantly, you should verify that the refresh token flow is properly implemented. Mobile apps should store refresh tokens securely in the device keychain and automatically request new access tokens before expiration. The 60-minute window is tight for warehouse operations - consider implementing a proactive refresh at 50 minutes instead of waiting for expiration. Also check if your token rotation policy allows overlapping tokens during the refresh window to prevent gaps in authentication.

5

Token expiration policies need careful tuning for mobile scenarios. 3600 seconds is reasonable, but your refresh implementation might be the issue. Are you using the grant_type=refresh_token properly? Also, mobile apps behave differently than web apps with CORS - you might need to configure your OAuth2 server to accept requests without Origin headers or with custom mobile app identifiers.

7

We had this exact problem last quarter. The issue was twofold: CORS misconfiguration AND the mobile app wasn’t handling token refresh correctly. Make sure your refresh token endpoint allows POST requests from your mobile origin. Also, implement a token refresh interceptor that catches 401 responses and automatically refreshes before retrying the original request. This prevents the user from seeing authentication failures during active operations.

8

The CORS preflight failure is your smoking gun. For mobile OAuth2 implementations in CloudSuite, you need to configure both the API gateway and the OAuth2 authorization server. Check your ICS 2023.1 security settings - there should be a CORS configuration section where you can add allowed origins. For mobile apps, you might need to use a wildcard or specific app scheme like ‘app://warehouse.mobile’. Additionally, ensure your refresh token rotation isn’t too aggressive - if new refresh tokens are issued on every refresh, make sure the old ones remain valid for a grace period.