How to Configure Windows Sandbox Local Traefik BasicAuth Middleware via XML in Windows 11

Validating HTTP Basic Authentication challenges across API microservices requires a clean testing environment free from browser password caches or host-level credential vaults. Traefik’s BasicAuth middleware protects edge routes using standard htpasswd credential files. Windows Sandbox in Windows 11 provides a secure, disposable Hyper-V container ideal for verifying BasicAuth workflows safely.

Why Test BasicAuth in Windows Sandbox

Testing authentication workflows in standard host environments often creates confusing session caching issues where browsers remember previous authorization headers. Windows Sandbox provides a pristine, isolated runtime where credential challenges can be validated repeatedly without cache pollution.

Authoring the Windows Sandbox WSB XML

Save the following XML document as TraefikBasicAuthSandbox.wsb on your Windows 11 machine:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TraefikAuthLab</HostFolder>
      <SandboxFolder>C:\TraefikAuthLab</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\TraefikAuthLab\setup-basicauth.ps1</Command>
  </LogonCommand>
</Configuration>

PowerShell Deployment Bootstrapper

Save the bootstrapping script as C:TraefikAuthLabsetup-basicauth.ps1:

Write-Host "Setting up Traefik BasicAuth Lab..." -ForegroundColor Cyan

$Dir = "C:Traefik"
New-Item -ItemType Directory -Force -Path $Dir | Out-Null

$ZipUrl = "https://github.com/traefik/traefik/releases/download/v3.0.0/traefik_v3.0.0_windows_amd64.zip"
Invoke-WebRequest -Uri $ZipUrl -OutFile "$Dir	raefik.zip"
Expand-Archive -Path "$Dir	raefik.zip" -DestinationPath $Dir -Force

# Generated htpasswd for user 'admin' with password 'secret'
$Config = @"
http:
  middlewares:
    auth-middleware:
      basicAuth:
        users:
          - "admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
  routers:
    secure-router:
      rule: "PathPrefix(`/secure`)"
      middlewares:
        - "auth-middleware"
      service: "secure-service"
  services:
    secure-service:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:8080"
"@

Set-Content -Path "$Dirdynamic_conf.yml" -Value $Config
Write-Host "BasicAuth Middleware Configured for Route /secure." -ForegroundColor Green

Testing Authentication Challenges

Launch the sandbox configuration and run curl requests against http://127.0.0.1/secure. Confirm that unauthenticated requests receive HTTP 401 Unauthorized with WWW-Authenticate challenges, while requests supplying valid credentials succeed cleanly.