Role of the ASP Engine in Windows 2000 IIS 5.0

This article examines the critical role of the Active Server Pages (ASP) engine within Internet Information Services (IIS) 5.0 on Microsoft Windows 2000. It covers how the engine functions as an ISAPI extension, processes dynamic server-side scripts, manages application state, and interfaces with COM+ components to serve dynamic web pages to clients.

Core Architecture and the ISAPI Interface

In IIS 5.0, the ASP engine is implemented as an Internet Server Application Programming Interface (ISAPI) dynamic link library named asp.dll. When a web browser requests a file with the .asp extension, IIS bypasses its static file-handling pipeline and routes the request directly to asp.dll. The ASP engine intercepts the incoming HTTP request, reads the requested template from the file system, and executes any server-side logic embedded within the file before sending standard HTML back to the client.

Script Parsing and Execution

The primary duty of the ASP engine is parsing and executing server-side code. By default, it supports Microsoft VBScript and JScript, though it can use any Active Scripting-compliant language engine installed on Windows 2000.

During execution, the engine distinguishes between raw HTML markup and server-side code delineated by <% ... %> tags. The script engine processes logic, evaluates conditions, and computes data on the server. The resulting output is merged with the static HTML markup, ensuring the client browser receives only pure HTML, CSS, or client-side JavaScript, keeping proprietary server-side logic secure.

Exposure of Intrinsic Objects

The ASP engine instantiates and manages six core intrinsic objects that allow developers to interact with the web server environment:

  • Request: Captures data passed from the client via HTTP query strings, form post bodies, headers, and cookies.
  • Response: Controls the data sent back to the client, including HTTP headers, cookies, redirects, and HTML content.
  • Server: Provides utility functions, such as encoding strings (Server.URLEncode), mapping physical file paths (Server.MapPath), and instantiating external components.
  • Session: Stores user-specific data across multiple page requests using a unique session identifier stored in a non-persistent cookie.
  • Application: Manages global state and shared variables accessible by all users across the entire web application.
  • ObjectContext: Manages transactional operations coordinated by COM+ services.

Integration with COM+ and Component Services

Windows 2000 introduced COM+ (Component Services), and IIS 5.0 utilized this infrastructure for process isolation and scalability. Through the Server.CreateObject method, the ASP engine instantiates COM components to perform advanced tasks such as database interaction via ActiveX Data Objects (ADO).

The ASP engine in IIS 5.0 can run in three distinct application protection levels:

  • Low (IIS Process): Runs inside the main inetinfo.exe process for maximum speed, though a crash in script execution can bring down the web server.
  • Medium (Pooled): The default setting in IIS 5.0, which executes ASP applications within a shared dllhost.exe surrogate process, balancing performance and system stability.
  • High (Isolated): Runs the ASP application in its own dedicated dllhost.exe process, fully isolating it from other applications on the server.

State and Session Management

The ASP engine handles state tracking in what is otherwise a stateless HTTP environment. By assigning each visitor an encrypted ASPSESSIONID cookie, the engine tracks user activity and allocates isolated server-side memory for individual user sessions. It monitors session timeouts, automatically destroying session objects and releasing system resources when a user becomes inactive.