ISAPI Extensions Guide
ISAPI Extensions Guide
ISAPI (Internet Server Application Programming Interface) lets you write high-performance DLLs that run inside the IIS process. ISAPI extensions handle requests directly; ISAPI filters intercept requests before they reach the extension.
ISAPI Extensions vs. Filters
| Feature | Extension | Filter |
|---|---|---|
| Purpose | Processes HTTP requests and generates responses | Modifies or inspects requests/responses in the pipeline |
| Entry Points | HttpExtensionProc, GetExtensionVersion | HttpFilterProc, GetFilterVersion |
| URL Mapping | Mapped by file extension (e.g., .asp → asp.dll) | Runs on every request to the site |
| Examples | ASP engine (asp.dll), custom CGI replacement | URL rewriting, custom authentication, logging |
How ASP Works (ISAPI Extension)
The ASP engine (asp.dll) is an ISAPI extension. When IIS receives a request for a .asp file, it passes the request to asp.dll, which parses the file, executes the VBScript or JScript code, and returns the HTML output to the client.
Application Mappings
Application mappings associate file extensions with ISAPI DLLs. To view or modify them:
- Right-click the web site → Properties → Home Directory tab → Configuration.
- The App Mappings tab shows all registered extensions.
| Extension | ISAPI DLL |
|---|---|
| .asp | C:\WINNT\System32\inetsrv\asp.dll |
| .asa | C:\WINNT\System32\inetsrv\asp.dll |
| .cdx | C:\WINNT\System32\inetsrv\asp.dll |
| .cer | C:\WINNT\System32\inetsrv\asp.dll |
| .shtml | C:\WINNT\System32\inetsrv\ssinc.dll |
Security Considerations
- Remove unused ISAPI mappings to reduce attack surface (e.g.,
.htr,.idc,.printer) - ISAPI extensions run in the IIS process: a bug can crash the entire server. Test thoroughly.
- Use the IIS Lockdown Tool to remove unnecessary extensions and features.