How can I restrict access to a static HTML page served from a subfolder of my site to authenticated users only? I have a Drupal 8 site that has all roles and permissions necessary for authenticated users. One of the new requirements is to serve a static microsite (like a campaign site, totally different design compare to Drupal site) which is a single folder with all the static assets (HTML, CSS, JS , images). We have to serve this site under the same domain drupal is hosted and should be accessed ONLY by authenticated users.

I tried to host it under sites/default/files/ directory, but it means it is public and anyone can access it.
One of the options to achieve this is using drupal's private file system. Drupal core out-of-box provides a way to access private files in a secured URL. Here are the steps:


upload the directory (e.g. foo-bar) to drupal's private file scheme. (you can find it under  Administration->Configuration->Media->File system)
Create a hook_file_download($uri) in a custom module and check for necessary access conditions:

function mymodule_file_download($uri) {

  // Check user permission only if the requested
  // file is under foo-bar directory. 
  if (strpos($uri, 'foo-bar') !== FALSE) {
    if (\Drupal::currentUser()-&gt;isAnonymous()) {
      return -1
    }

    // Return a header to inform access is granted.
    return ['Cache-Control' =&gt; 'private'];
  }
}

Now the directory is available for authenticated users at www.example.com/system/files/foo-bar/index.html.


Check Drupal\system\FileDownloadController::download() for more details 

This would work for both Drupal 8 &amp; 9. I haven't checked 7.