Expired JWT token triggers 401 in Angular HttpInterceptor without automatic redirect or refresh

Goal: Ensure that Angular applications enforce least‑privilege access through route guards while gracefully handling expired JWT credentials.

Constraints: Route guards execute synchronously; any asynchronous token validation must return a Promise or Observable, which can affect navigation timing. An HttpInterceptor can detect 401 responses, but automatically refreshing the token inside the interceptor risks infinite loops if the refresh endpoint also returns 401, requiring additional guard conditions.

Uncertainty: Teams disagree on whether refresh logic should reside in the interceptor, a dedicated AuthService, or a third‑party library, and how to guarantee that guards evaluate the refreshed token without blocking the UI.

Should token refresh be performed inside the HttpInterceptor with loop protection, delegated to a dedicated AuthService, or handled by a third‑party library? How can teams ensure that route guards receive the refreshed token before evaluating least‑privilege claims without causing navigation delays? What verification steps confirm that a chosen refresh strategy avoids infinite loops and maintains responsive UI?