Using ISAPI Filters

[Editor's Note: Email your IIS-related solutions (400 words or less) to R2R at [email protected]. We'll edit submissions for style, grammar, and length. If we print your contribution, you'll get $100.]

Conversations about Internet Server API (ISAPI) usually include the word extension or filter. Extensions and filters differ from each other. Extensions have become virtually obsolete, thanks to advances in Active Server Pages (ASP) technology, but you can't replace ISAPI filters.

ISAPI filters literally filter each HTTP request to IIS. As a developer, you can capture specific events from IIS and pre- or postprocess the results. For example, if I want to create a customized log for every Web request, I can capture each HTTP request and log the information to a text file or database; I can further extend the log to include specific information from the Active Directory (AD) for the authenticated user. Or if I need to authenticate against a legacy database, I can capture the authentication event and perform the appropriate actions. All I'm doing is extending the functionality of IIS.

However, ISAPI filters have their drawbacks. A filter is invoked for every HTTP request, so you must be careful that you design the filter properly. Making sure you allocate and deallocate memory correctly is crucial. If you've failed to deallocate even one byte, each HTTP request will cause IIS to consume an additional byte of memory. Also, if the ISAPI filter is flawed, it can prevent IIS from servicing all HTTP requests.

Setting up ISAPI filters through the Microsoft Management Console (MMC) is simple. Right-click the Web site instance on which you want to install the ISAPI filter, then select Properties. Click the ISAPI Filters tab. You'll see three columns of information labeled Status, Filter Name, and Priority, respectively. The status will be green if IIS was able to load the ISAPI filter. Priority refers to the order in which ISAPI filters execute, which is especially important for ISAPI filters that process the same events. Filters with the same priority process sequentially in the order in which they appear. If you want an ISAPI filter to process across all Web site instances, you can add the filter to the master properties of the WWW Service. To add a filter to the master properties, right-click the machine name within the MMC. Select the properties item and the properties dialog for the entire Web server launch. Select WWW Service from the Master Properties drop-down list, then click Edit. You'll see a dialog box similar to the properties of a single Web site.

—Rodney Guzman
[email protected]