How do Angular route guards and lazy loading work together?
The router supports guards that run during navigation: CanActivate, CanActivateChild, CanDeactivate for unsaved forms, CanMatch for feature flags, and Resolve to prefetch data. A guard can return a boolean, an Observable, a Promise, or a UrlTree to redirect. Functional guards can use inject().
export const authGuard: CanActivateFn = () => {
const auth = inject(AuthService);
const router = inject(Router);
return auth.isLoggedIn() ? true : router.parseUrl('/login');
};
Lazy loading uses loadChildren for a group of routes or loadComponent for a single standalone component, so the browser downloads that chunk only when the route is visited. Combine it with preloadingStrategy: PreloadAllModules to fetch chunks after the initial render.
Always enforce authorisation on the server as well; client guards improve UX but are not a security boundary. Keep guards small and side-effect free, and return a redirect tree rather than navigating imperatively inside the guard.