How can I restrict access to a static HTML page served from a subfolder of my site to authenticated users only?
One of the options to achieve this is using drupal's private file system. Drupal core out-of-box provides a way to access private files in a secured URL. Here are the steps:


upload the directory (e.g. foo-bar) to drupal's private file scheme. (you can find it under  Administration->Configuration->Media->File system)
Create a hook_file_download($uri) in a custom module and check for necessary access conditions:

function mymodule_file_download($uri) {

  // Check user permission only if the requested
  // file is under foo-bar directory. 
  if (strpos($uri, 'foo-bar') !== FALSE) {
    if (\Drupal::currentUser()-&gt;isAnonymous()) {
      return -1
    }

    // Return a header to inform access is granted.
    return ['Cache-Control' =&gt; 'private'];
  }
}

Now the directory is available for authenticated users at www.example.com/system/files/foo-bar/index.html.


Check Drupal\system\FileDownloadController::download() for more details 

This would work for both Drupal 8 &amp; 9. I haven't checked 7.