Introduction to ISAPI

ISAPI provides a vendor-independent API to extend the functionality of your web server, while avoiding performance limitations inherent to CGI. ISAPI was originally proposed, and is still backed up by Microsoft, but was designed to be an open standard that anyone can implement and use.

ISAPI follows a simple model, where 'callback' functions implemented by the web server backend can be invoked by a user written module. These callback functions can either retrieve data from the web server or from the HTTP client (a.k.a., browser), send data to the HTTP client or change some state in the web server.

ISAPI defines a standard set of callback functions that a server must implement, but because the standard is open, specific vendors may implement specific functionality that may exist only within its own product.

In/out of process

When using ISAPI modules with the Zeus Server you must remember that the 'out-of-process' ISAPI runner is a multi-threaded server. This means that there could be several threads in your ISAPI application at any one time, so you should write your application in a thread safe way.

Due to the nature of ISAPI, 'in-process' modules run as part of the server core. This means that if they have any unexpected behavior, the web server itself could suffer. More seriously, due to the way the Zeus Server works, it is possible for a malicious ISAPI module to set the effective user id back to the user that started the server (possibly root). Do not use un-trusted code in ISAPI applications.

When an ISAPI module is being run by the web server, the file is mapped into the address space of the web server process. If you overwrite or delete the file then you can corrupt the address space of the web server process causing it to crash. Filters are constantly mapped in. Extensions will get mapped in when they are first used, and may be left mapped in, cached in memory after they have been used. You should take special care in these cases.

Getting started

Please refer to our getting started guide. There is a reference guide in the ISAPI Programming Documentation.

Advantages

• Powerful API, includes both content generation, authorization along with low-level APIs to rewrite incoming or outgoing content and modify the server behaviour in many ways

• In-process ISAPI provides highest-performance API

• Out-of-process ISAPI provides multi-threaded application server.

Disadvantages

• Must be written in C or a C-derived language, such as C++.

• In-process ISAPI load customer code directly into the web server, so it must be trustworthy and stable. (It will run as the same permissions as the web server process, and if the ISAPI crashes or leaks memory or file descriptors, it will bring down the entire web server)

• Out-of-process ISAPI applications must be MT-safe (multi-threaded). Writing stable multi-threaded applications is the domain of a professional software team, and is complicated and very difficult to debug

• Out-of-process ISAPI applications all load into a single multi-threaded application server, so all applications run with the same security permissions. ISAPI applications must comprise trusted code.

Content Manager [Administrator] 16 December 2005