Chapter 17: ISAPI Extensions

Overview

Internet Server Application Program Interface (ISAPI) comprises the API of Internet Information Services (IIS). ISAPI consists of supporting classes and structures that aid in the programmatic exploitation of IIS. Web applications that use ISAPI to interact with IIS interact in the most efficient way possible on a Windows web server. The layers of supporting software or interpretation between IIS and the web application are greatly diminished when the developer uses ISAPI. All Microsoft web application software uses ISAPI technology, either directly or indirectly. For example, Microsoft’s Application Server Pages (ASP) and .NET Framework are built as ISAPI applications.

Originally, ISAPI was marketed toward Common Gateway Interface (CGI) programmers as an alternative to writing CGI programs or as an easy upgrade from a CGI executable. Because many CGI executables were written in C++ or C, integrating an existing CGI web application would be quite simple. Converting a CGI web application to use ISAPI would also provide a great performance boost to the web application. CGI spawns a new process with each HTTP request; as a result, the technology demands a large amount of resources from the host server to create and destroy the CGI processes. Since ISAPI extensions are loaded in the process space of IIS, the host bears no burden associated with spawning a new process with each HTTP request. Because Windows loads a dynamic link library (DLL) into memory space once on the initial call to a function in the DLL and keeps it in memory for an indefinite amount of time, the ISAPI extension would remain loaded and likely not removed until an IIS server shutdown or unless the instance or virtual directory was unloaded. In this way, Microsoft offered a compelling reason for programmers to adopt the use of ISAPI in lieu of CGI and an easy upgrade path from CGI.

ISAPI is a good choice for developers who are producing software or have already written a software application in C++ for a product that is being distributed on the open market. If performance is critical and a development time longer than the typical web script file effort can be accommodated, ISAPI should be considered. In addition, ISAPI can perform some sophisticated tasks on the host server that cannot be performed with any other technology. ISAPI software can also be written to execute in such a manner that other web applications written in scripted languages that used other ISAPI extensions for interpretation, such as the .NET Framework or ASP.DLL, would be oblivious to the tasks being performed by the ISAPI extension.

On the downside, ISAPI is complicated to work with and difficult to debug. Stepping through code in the Visual Studio .NET Integrated Design Environment (IDE) is difficult, and since IIS is running as a multi-threaded process, unpredictable results can occur while debugging. The slightest bug in an ISAPI application can have a catastrophic result on IIS performance. Compared to all other development environments, ISAPI is the most unforgiving technology to use to build a web application.

In addition, ISAPI must be written using unmanaged C++ code. The new features offered by Visual Studio .NET for managed C++ code through the .NET Framework cannot be used in an ISAPI project.

Note 

If a program is written using managed code, that means that the software is written with code that uses the .NET Framework. C# and Visual Basic both use the .NET Framework. The term managed is representative of the fact that the .NET Framework manages memory cleanup, memory allocation, and other low-level resource management. Software written in C++ does not use the .NET Framework unless you use Managed Extensions for C++. Managed C++ means that the software uses the .NET Framework through the introduction of Managed Extensions for C++. C++ code written as usual, without using the Managed Extensions for C++, is unmanaged C++ and does not use the .NET Framework.