We have a site that requires users to sign into. Typical stuff. Today, all the content (dynamic and static) is behind the login process, and you cannot access any of the pages or files via a URL unless you are logged in. This even applies for images, css, js, etc. This is a requirment, the content cannot be open to the world.
We have been thinking of moving the static content off to a separate server for performance and scalability reasons, but are unsure how to do this, and still have these files secure and not open to the world. Basically, the authentication would need to be passed to the separate server (or CDN) and verified before we could serve it up.
Perhaps this is not possible, and it is not a good case for separating static and dynamic content.
We are running a Microsoft Stack - ASP.NET, IIS 6, but could go IIS 7-7.5.