I just built a complete password-protected ASP.NET 2.0 application for a client and they asked me a question that I couldn't answer.  

Can search engine spiders get into the password-protected site?

If that's the case, then generally speaking, all of the content inside the application could be available in some search engine which would defeat the purpose of the password-protection.  Does anyone know how this works and if it's possible for spiders and other search engine bots can catalog password protected content?

Thanks,

Kahanu
 

Spiders can get pages (to index them) only by http protocol like every user do via browser, and if you protected any page with password so spider will be asked to enter password too like any other user :)