Where should expired token handling live in Angular—interceptor or guard—to avoid infinite retry loops while enforcing least-privilege navigation?
Context Angular provides no built-in authentication, session management, or token-refresh service. Developers must implement expired credential handling using HttpClient interceptors for API calls and router guards for navigation protection. Problem When an access token expires, a 401 response triggers the interceptor to refresh and retry. However, if the re