provideRouter redirectUnauthorizedRequest with least-privilege role boundary and token expiration

Answer to the question

Angular’s provideRouter does not expose a redirectUnauthorizedRequest option. The only built‑in mechanism for redirecting on guard failure is to return a UrlTree from the guard itself. Therefore the responsibility for distinguishing unauthenticated, insufficient‑role, and expired‑token scenarios lies entirely in the guard implementations.

Authentication vs. Role Checks

Typical practice is to split responsibilities into two guards:

• AuthGuard – verifies that a token exists and is still valid.
• RoleGuard – confirms that the authenticated user possesses the required role(s).

Each guard returns one of the following:

• true – navigation proceeds.
• false – navigation is cancelled (useful only for canDeactivate).
• UrlTree – the router navigates to the supplied URL, bypassing any automatic redirect logic.

Token Expiration Handling

Because the router cannot detect token expiry on its own, the AuthGuard must synchronously inspect the stored token. A typical pattern is:

export class AuthGuard implements CanActivate {
  constructor(private auth: AuthService, private router: Router) {}

  canActivate(): UrlTree | boolean {
    const token = this.auth.getToken();
    if (!token) {
      // No token – redirect to login
      return this.router.parseUrl('/login');
    }
    if (this.auth.isTokenExpired(token)) {
      // Expired token – redirect to a dedicated page
      return this.router.parseUrl('/session-expired');
    }
    return true;
  }
}

If you prefer a single UI for both missing and expired credentials, simply return the same UrlTree (e.g. /login) for both cases.

Role‑Based Authorization

The RoleGuard should explicitly return a UrlTree when the user lacks the required role. This bypasses any generic “unauthenticated” redirect and gives the user a clear “access denied” page.

export class RoleGuard implements CanActivate {
  constructor(private auth: AuthService, private router: Router) {}

  canActivate(): UrlTree | boolean {
    const roles = this.auth.getUserRoles();
    const required = ['Admin']; // injected or hard‑coded per route
    const hasRole = required.some(r => roles.includes(r));
    if (!hasRole) {
      return this.router.parseUrl('/unauthorized');
    }
    return true;
  }
}

Router Configuration

Because there is no redirectUnauthorizedRequest option, your route definitions simply list the guards:

const routes: Routes = [
  {
    path: 'admin',
    component: AdminComponent,
    canActivate: [AuthGuard, RoleGuard]
  },
  { path: 'login', component: LoginComponent },
  { path: 'unauthorized', component: UnauthorizedComponent },
  { path: 'session-expired', component: SessionExpiredComponent }
];

@NgModule({
  imports: [RouterModule.forRoot(routes)],
  exports: [RouterModule]
})
export class AppRoutingModule {}

Guard Ordering and Token Refresh

Guards run before navigation starts, so any HTTP interceptor that attempts to refresh a token will not affect the guard’s decision unless the interceptor runs synchronously or the guard checks the refreshed state. A common pattern is to perform a quick synchronous check (e.g. decode the JWT) in AuthGuard and only fall back to an interceptor‑driven refresh when the guard decides the token is missing or expired.

Diagnostic Question

To fine‑tune this setup, it would help to know whether your authentication token is stored in a client‑side store (e.g. localStorage) or in an HttpOnly cookie. The storage medium determines whether the guard can synchronously inspect the token and how a token‑refresh interceptor can be coordinated.

Summary

Angular’s router does not provide a redirectUnauthorizedRequest option. Authentication, role checks, and token‑expiration handling must be implemented explicitly in guards that return a UrlTree for each failure scenario. This gives you full control over the UX while keeping the least‑privilege principle intact.