ASP in a Nutshell, 2nd Edition

The Dynamic Internet Part II: ISAPI

In addition to supporting the CGI specification, Microsoft introduced an alternative to CGI, the Internet Server Application Programming Interface (or ISAPI). ISAPI addresses one of the most limiting features of CGI applications.

Each time a client requests the execution of a CGI application, the web server executes a separate instance of the application, sends in the user's requesting information, and serves the results of the CGI application's processing to the client. The problem with this approach is that a separate CGI application is loaded for each request. This can be quite a drain on the server's resources if there are many requests for the CGI application.

ISAPI alleviates this problem by relying on dynamic link libraries (DLLs). Each ISAPI application is in the form of a single DLL that is loaded into the same memory space as the web server upon the first request for the application. Once in memory, the DLL stays in memory, answering user requests until it is explicitly released from memory. This increased efficiency in memory usage comes at a cost. All ISAPI DLLs must be thread-safe so that multiple threads can be instantiated into the DLL without causing problems with the application's function.^[1]

ISAPI applications are normally faster than their equivalent CGI applications because the web server does not have to instantiate a new application every time a request is made. Once the ISAPI application DLL is loaded into memory, it stays in memory. The web server does not need to load it again.

In addition to ISAPI applications, ISAPI allows for the development of ISAPI filters. An ISAPI filter is a custom DLL that is in the same memory space as the web server and is called by the web server in response to every HTTP request. In this way, the ISAPI filter changes the manner in which the web server itself behaves. The ISAPI filter then instructs the web server how to handle the request. ISAPI filters thus allow you to customize your web server's response to specific types of user requests. To state the difference between ISAPI filters and ISAPI applications (and CGI applications) more clearly, ISAPI filters offer three types of functionality that set them apart from ISAPI (or CGI) applications:

• An ISAPI filter allows you to provide a form of web site or page-level security by its insertion as a layer between the client and the web server.

• An ISAPI filter allows you to track more information about the requests to the web server and the content served to the requestor than a standard HTTP web server on its own can. This information can be stored in a separate format from that of the web server's logging functions.

• An ISAPI filter can serve information to clients in a different manner than the web server can by itself.

Here are some examples of possible ISAPI filters:

• A security layer between the client and the web server. This security layer could provide for a more thorough screening of the client request than that provided for by straight username and password authentication.

• A custom filter could interpret the stream of information from the server and, based on that interpretation, present the stream in a different format than would the original web server. The ASP.DLL (see the following section) is an example of this type of ISAPI filter. It interprets the server code in a script requested by the client and, depending on its interpretation, serves the client customized content according to the client's request.

• A custom filter could map a client's request to a different physical location on the server. This could be used in high-volume sites where you might want to move the client onto a different server.

---

^[1] As of version 4.0, Microsoft Internet Information Server allows you to load CGI applications into the same memory space as the web server, just as you can ISAPI applications.