BasicAuth middleware credential expiration and revocation

BasicAuth Middleware Configuration

Traefik's BasicAuth middleware provides a mechanism for securing routes using static credentials, typically defined via an htpasswd-formatted string or file. This implementation validates requests based on a direct match of the username and password.

While this satisfies basic authentication needs, the middleware lacks a native mechanism to evaluate credential metadata, such as expiration timestamps or revocation status. In environments requiring least-privilege access and strict credential lifecycles, relying on static entries necessitates external rotation processes to prevent stale access.

Given that the middleware does not natively support time-based validity or external revocation checks, what are the recommended architectural patterns for enforcing credential expiration within the Traefik proxy layer? Can the BasicAuth handler be extended to interface with external revocation sources without moving to a full ForwardAuth implementation?