What they are
A route guard runs before a protected route renders and decides whether navigation may proceed. If the user is not allowed, the guard cancels or redirects, usually to a login page.
Common checks
- Authentication: is there a valid session or token.
- Authorization: does the user have the required role or permission.
- Conditions: is data loaded, or has a form been saved before leaving.
Where it runs
Guards run on the client for responsiveness, but they are not security. The server must re check every request, because a determined user can bypass client code.
Redirect and return
A good guard remembers the intended URL and sends the user back there after login, instead of dumping them on a generic home page.
Why it matters
Guards centralize access rules so each component does not reimplement them, and they keep unauthorized UI from flashing before a redirect.
Key idea
Route guards gate navigation on auth and roles, redirecting when denied, but real protection still requires server side checks.