I'm submitting a ... (check one with "x")

[X] bug report => search github for a similar issue or PR before submitting
[ ] feature request
[ ] support request => Please do not submit support request here, instead see https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question

Current behavior
When both a route and it's parent have an asynchronous canActivate guard, and the child is navigated to directly, both guards are run at same time.

Expected behavior
The parent's canActivate guard should run before the child's guard. If the parent's guard is unsuccessful the child guard should not be run. If a route defines multiple canActivate guards, those can/should be run in parallel.

Minimal reproduction of the problem with instructions
http://plnkr.co/edit/s4R0INS7qjuFnRpyD8eF?p=preview

Plunker has a nested route /parent/child. Both have guards that simply wait and then return true. Each guard logs its start/end as well as a tick once per second to a logging service that is displayed in the root component.

Click 'Go to Child` to trigger both the Parent Guard and the Child guard at the same time, and observe that they process simultaneously in the log.

What is the motivation / use case for changing the behavior?

In my athepp, ParentGuard checks to see if the user is authenticated and redirects accordingly, and ChildGuard loads protected data. Right now, my child guard cannot assume the user is logged in, so I have to duplicate logic from the authorization guard to wait for the user to be loaded. When I have a grandchild route, that has to duplicate logic from two parent guards. I would like to be able to separate concerns more rather than duplicate auth logic in all my guards.

Please tell us about your environment:

• Angular version: 4.0.1