Understanding and Using ISAPI
Microsoft originally introduced ISAPI as a means of making IIS easier to work with. Developers could create new modules as needed, and administrators could install the new modules without a lot of help. It's still a good idea, but the technology is getting outdated. As developers work on new ways to improve modularity, the techniques used in ISAPI look less appealing because you have to write complex code to implement them. In addition, ISAPI tends to suffer from viruses and other problems.
ISAPI comes in two forms. ISAPI extensions provide improved functionality and data processing. ISAPI filters monitor the flow of data and manipulate it as needed. The following sections describe both forms of ISAPI.
Working with ISAPI extensions
Developers originally created ISAPI extensions using C and then C++. The technology was supposed to replace CGI, and it did in many ways. ISAPI extensions offer many features not found in CGI applications. One of the most important considerations for using ISAPI with IIS 7 is that it's more efficient - you don't have to create a new process for every caller. The article at http://msdn2.microsoft.com/en-us/library/ms525913.aspx provides a good comparison of various IIS development technologies, including a comparison of both ISAPI and CGI.
Microsoft also relied heavily on ISAPI extensions at one point. Most applications in IIS 6 rely on ISAPI extensions to perform tasks. The technology has changed for IIS 7. Now many of the applications that run in IIS use the .NET Framework instead, which provides a significant number of security, reliability, and performance benefits. You can read an excellent comparison of how Microsoft has changed from ISAPI to the .NET Framework in the article at http://weblogs.asp.net/scottgu/archive/2007/04/02/iis-7-0.aspx. The bottom line is that even though you can continue to use ISAPI extensions, the mainstream of IIS 7 development is headed toward use of the .NET Framework for server extensions.
Security is considerably pickier when working with IIS 7 than it was for previous versions of IIS. You must make certain that the user has access to the executable and all configuration files to make the ISAPI extension work as intended. Unlike with a script-based solution, however, you can often get by with giving the user access to the executable and not to the entire folder. In some respects, the less-intensive access requirements actually make ISAPI a little more secure than script-based solutions, such as ASP. Of course, ISAPI extensions don't share the security features of managed executables, so you still make some tradeoffs to use them.
You use ISAPI extensions differently from script-based solutions. In most cases, you won't move the ISAPI extension to a new folder on the system; you simply redirect the pointer to the ISAPI extension as needed. For example, when a user accesses your ISAPI extension for a particular resource, you create a handler mapping by using the technique found in the "Adding a script map" section of this tutorial.
Managing ISAPI filters
ISAPI filters work very much like their name implies: They monitor the data stream between the client and the server and filter it as necessary. Unlike with ISAPI extensions, you can't call an ISAPI filter directly, but must configure it to monitor the data stream in particular ways. To display the ISAPI filters for a Web server or Web site, select the Web server or Web site in the Connections pane and double-click the ISAPI Filters icon in Features view. You see the standard list of ISAPI filters in the ISAPI Filters window, along with any additional ISAPI filters you installed. The following sections discuss how you configure ISAPI filters on IIS 7.
Adding ISAPI filters
Normally, any third-party product you install also installs any required ISAPI filters for you. However, you might need to install a custom ISAPI filter or a special ISAPI filter that you obtained from a third-party source rather than as part of an application. The following steps tell how to install an ISAPI filter:
- Click Add in the Actions pane. You see the Add ISAPI Filter dialog box.
- Type the name of the ISAPI filter in the Filter Name field.
- Provide a location for the executable (either a DLL or EXE file) in the
Executable field. You can also use the Browse button to locate the executable file on disk.
Warning: Make sure that you choose the correct ISAPI filter executable. IIS doesn't perform any checking on the ISAPI filter when you install it. The executable you choose could literally contain any information.
- Click OK to complete the process.
- Restart the Web server or Web site to ensure that the new ISAPI filter is in the processing loop.
Editing ISAPI filter settings
If you choose the wrong ISAPI filter executable or you have an updated version of the ISAPI filter you want to use, you can easily modify the entry as needed to correct it. Modifying an existing ISAPI filter is similar to adding one. Highlight the ISAPI filter you want to change and click Edit in the Actions pane, and you see the Edit ISAPI Filter dialog box. Make the required changes and click OK to complete the process. You can't change the name of the ISAPI filter by using the Edit option.
'Removing an ISAPI filter
At some point, you probably need to remove an ISAPI filter that you added previously. Remove only ISAPI filters that you add manually. Your setup requires the default IIS ISAPI filters in most cases. In addition, third-party products normally remove ISAPI filters as part of the uninstall process. To remove an existing ISAPI filter, highlight the ISAPI filter in the list and click Remove in the Actions pane. IIS asks you to confirm that you want to remove the ISAPI filter. Click Yes to complete the process. Restart the Web server or Web site to ensure that IIS removes the ISAPI filter from the processing loop.
Renaming an ISAPI filter entry
You may decide to rename an ISAPI filter entry so that it better reflects the purpose of the ISAPI filter. To perform this task, highlight the ISAPI filter entry you want to change and click Rename in the Actions pane. IIS turns the ISAPI filter name entry into an edit box. Type the new name and press Enter to complete the process.