I solved this as described in the following post (and comments): https://community.intersystems.com/node/507036

But since this approach is somewhat cumbersome and some time has passed since, I wonder if anyone has found a better way to deliver static files via WebApp and put the IRIS login page in front of it for authentication?

Since having AutoCompile enabled comes with security issues and won't even work out-of-the-box from IRIS version 2025.1 onwards (see https://docs.intersystems.com/iris20251/csp/docbook/changes/index.html#C...) I came up with a solution without the need of enabling the AutoCompile-option in the WebApp:

We just have to make sure that the index.csp is compiled once. To do so, we call $SYSTEM.CSP.LoadPageDir("/my-app", "ck") right after we create the WebApplication programmatically.

Example from our IPM module.xml:

    <!-- Compile all csp files of webapp /my-app -->
    <Invoke Class="%SYSTEM.CSP" Method="LoadPageDir" CheckStatus="true">
        <Arg>/my-app</Arg>
        <Arg>ck</Arg>
    </Invoke>