Microsoft Corporation
While the World Wide Web currently provides a way to see documents across the world, its future capabilities range far beyond this one function. The Web's promise as a mechanism for distributing software will drive the creation of new categories of applications for entertainment, self-improvement, and all types of commerce. Businesses are pursuing these opportunities by setting up Internet sites that provide end users with an engaging interactive experience that attracts and retains "viewership." Many companies are also exploring the use of Web-based technologies to provide internal information and software applications to their employees. Businesses can use internal Webs, also known as intranets, for applications in areas such as software distribution, customer support, human resources, and finance.
Microsoft® ActiveX™ is a set of technologies that lets you build real business applications for the Internet and intranets that run across multiple platforms. Developers can write such applications using the programming languages C, C++, and Java™ and run these applications across platforms such as the Microsoft Windows® family, Macintosh®, and UNIX. Embracing both Java and OLE object technology, ActiveX provides promising new Internet and intranet capabilities while extending and capitalizing upon existing customer investments.
For example, a corporate developer can create an application to retrieve employee information by writing a Java applet for the user interface and by using functionality from an existing software component that interfaces with a back-end database.
With ActiveX, developers and Web producers can create compelling, interactive content with a wide variety of tools from dozens of tool vendors. ActiveX provides interoperability on the client and the server between development tools, authoring tools, database products, and networking technologies. ActiveX embraces Internet standards and moves the Internet beyond static documents to provide users with a more interactive, exciting, and useful experience. ActiveX will give developers and Web producers a rich platform for innovative applications on the Internet, while preserving their investments in applications, tools, and source code.
Microsoft Internet Explorer 3.0 will debut ActiveX, bringing the power of ActiveX to end users and enabling them to view and run rich, powerful content and applications. Because ActiveX is also supported in Netscape Navigator (although it requires the ActiveX plug-in for Netscape Navigator, available from http://www.microsoft.com/), producers building ActiveX content can be ensured of the largest possible target audience.
With ActiveX, the following types of people benefit in these ways:
The past few years have seen the rapid growth of the Internet with increasing numbers of people using the World Wide Web for document retrieval. At the same time, powerful desktop and server personal computers have become less and less expensive, driving a revolution in productivity for individuals and businesses. ActiveX combines the benefits of the World Wide Web and the personal computer to enable interactive distributed applications and richer communications between users.
ActiveX also addresses an issue shared by many businesses that are increasingly looking to use Internet-based technologies for internal applications in areas such as software distribution, customer support, human resources, and finance. These applications require a "platform" that provides application developers a rich set of interoperable tools and components coupled with robust networking capabilities to enable seamless communication with Internet resources.
Microsoft ActiveX is an open integration platform that provides developers and Web producers the fastest and easiest way to create exciting interactive applications and content for the Internet and intranets.
Because ActiveX embraces existing desktop technologies, as well as new Web-based technologies such as Java, customers get the best of both the personal computer and the Web. Some specific benefits gained through this combination of technologies are:
As seen in Figure 1, ActiveX consists of a client-side platform, a server-side platform, development tools, authoring tools, and networking technologies. ActiveX will provide users, Webmasters, and developers with a rich platform for innovative applications on the Internet, while preserving their investments in applications, tools, knowledge, and code.
Figure 1. Microsoft ActiveX is an open platform for Internet/intranet applications.
ActiveX on the client is the client-side platform that enables applications and content to be run and viewed on an end user's system. Applications and content can be either present on the client system itself or automatically downloaded from the server and viewed and run on the client. ActiveX on the client consists of:
With ActiveX on the client, users can run ActiveX controls written in different languages, such as Java, Visual C++, Visual Basic, and others. ActiveX on the client supports HTML 3.0 content, including support for frames, stylesheets, and tables.
ActiveX on the server is the server-side platform that provides clients with Internet services, applications, data, and content. Applications and content can be hosted on the same server that runs the Web Server or on other systems. Data can be hosted in any SQL database or any database that supports Open Database Connectivity (ODBC). With ActiveX on the server, developers can write Common Gateway Interface (CGI) applications, Internet Server application programming interface (ISAPI) Dynamic Link Libraries (DLLs) that run on the server side, and scripts. ActiveX on the Server consists of:
For more detailed information on ActiveX on the Server, please refer to the section "Writing Server Side Applications."
Software developers can use ActiveX development tools to create exciting and powerful applications for the Internet and intranets. ActiveX development tools include new products such as Microsoft Visual J++, as well as established ones such as Microsoft Visual C++ and Visual Basic. This flexibility gives developers a wide selection of development tools and languages to create applications for the Internet and intranets.
ActiveX authoring tools enable Webmasters to develop exciting content for the Internet and intranets. These authoring tools are very simple to use and do not require extensive technical knowledge. Webmasters can use Microsoft FrontPage™ to create effective HTML content and to manage Web sites. For instance, a Web producer can, with a few "point and clicks", create a form in a Web page for getting feedback information.
Microsoft is currently working with Metrowerks Inc. to provide ActiveX on the Macintosh. Developers who write ActiveX controls in Java can be assured that their controls will run seamlessly on both Windows and the Macintosh through Internet Explorer. In addition, Macintosh developers will be able to write native Macintosh ActiveX controls in languages such as C++ using Metrowerks CodeWarrior development tools, and be assured that these ActiveX controls will run on Internet Explorer for the Macintosh. ActiveX on the client will be available on the Macintosh and end users will be able to run ActiveX controls written in Java, Visual C++, and Visual Basic using Internet Explorer for the Macintosh. Developers will also be able to write scripts in VB Script that will run on Internet Explorer for the Macintosh.
UNIX support is also provided. Developers can write ActiveX controls that run on all major UNIX systems today using software from Bristol Technology, Inc. and Mainsoft Corporation.
ActiveX provides choice in software, hardware, networking technologies, development tools, languages, and more to customers. ActiveX technologies are based on industry and organizational standards such as HTTP, TCP/IP, and OLE. Microsoft regularly previews ActiveX technologies to independent software vendors (ISVs) for feedback on design issues and incorporates this feedback into ActiveX technologies. MIS Decision Makers: Leverage Existing Investments, later in this paper, includes a partial listing of standards supported in ActiveX.
Internet Explorer 3.0 will debut ActiveX and bring the power of ActiveX to end users. Users can download Internet Explorer 3.0 today from http://www.microsoft.com/ie/ free of cost. Internet Explorer supports HTML as well as interactive multimedia content such as ActiveVRML and ActiveMovie. With Internet Explorer, end users will be able to run ActiveX controls created in languages such as Java, Visual C++, and Visual Basic, as well as Java applets. The Java support in Internet Explorer provides good Java performance and security to users. Users will be able to use Internet Explorer to seek information, do business, or just have fun on the Internet. Business users will be able to use Internet Explorer in areas such as human resources, customer support, finance, and accounting.
End users are protected from malicious applications because Internet Explorer ensures that only safe applications run on end-user systems. ActiveX controls that are hosted on Web sites trusted by the user can be downloaded and run on the end-user's system using all the features of the operating system. Users accept such trusted ActiveX controls just as they trust shrink-wrapped applications today for the desktop. Because ActiveX will not run the trusted control if it is modified after leaving the trusted Web site, the user is protected against malicious modification of applications during download.
On the other hand, ActiveX controls and Java applets on Web sites that are not trusted by an end user are not permitted to use all the features of the operating system. Because these untrusted ActiveX controls and Java applets are downloaded from a Web site and are limited to using a safe set of operating system features on the end-user system, they cannot compromise the security of the end-user system. Internet Explorer ensures that Java applets and untrusted ActiveX controls do not use the underlying operating system.
Internet Explorer supports trusted ActiveX controls that are written in languages such as Java, Visual C++, and Visual Basic. ActiveX supports those untrusted ActiveX controls written in the Java programming language.
While Internet Explorer has made viewing exciting content very simple for the end user, ActiveX allows developers to provide this content with relative ease and speed.
Developers will be able to write applications that run on ActiveX on the client by writing ActiveX controls in languages such as Java, Visual C++ and Visual Basic. ActiveX controls can work with other ActiveX controls or any COM object (see Figure 2). For instance, an ActiveX control written in Java can either expose COM interfaces or invoke a COM interface on another ActiveX control. Developers who write simple Java applets can be assured that these applets will work and interoperate seamlessly with other ActiveX components. Developers can also write scripts using VB Script or JavaScript that run on ActiveX on the client. ActiveX will be available on the Windows family and the Macintosh, and Microsoft plans to make it available on UNIX systems as well.
Figure 2. ActiveX runs ActiveX controls written in different languages, such as Visual C++ and Java.
Developers can take full advantage of the features provided by the targeted operating system with ActiveX controls written in many different languages. When a user clicks on a Web page that references an ActiveX control, that control is downloaded from the server and runs on the end-user's system. For instance, a developer could write a button ActiveX control that presents a dialog box asking the user for information.
Developers can choose from several tools such as Microsoft Visual C++, Borland C++, Symantec C++, and Microsoft's Java-based development tool, Visual J++. The next version of Microsoft Visual Basic—Visual Basic version 5.0—will enable developers to write ActiveX controls very easily. Developers will be able to convert existing Visual Basic code to ActiveX controls with simple point-and-click operations.
The Java reference implementation in Windows enables developers to run ActiveX controls in Java by writing .java files and exposing COM interfaces from Java classes using a type library. These .java files can then be compiled to generate .class files in the Java byte code format. The .class files then run on the Java reference implementation in Windows by first passing through a byte code verifier that ensures security for the end user. The .class code is then compiled with a Just-In-Time (JIT) compiler that is part of the reference implementation, which generates native code that runs on the user's system. This process is illustrated in Figure 3.
Microsoft is also publishing the interfaces for enabling other tool vendors to "plug in" their JIT compilers to the reference implementation, providing choice to developers and users. All the major tool vendors will enable this Java-ActiveX integration in their Java development tools.
In addition, Microsoft is working with Metrowerks to provide the same Java implementation on the Macintosh as well, so developers who write ActiveX controls in Java can be assured that their ActiveX controls will also run seamlessly on the Macintosh. In addition, Macintosh developers can use Metrowerks CodeWarrior tools to develop ActiveX controls in Java on the Macintosh. These ActiveX controls will work with other ActiveX controls written in the same or different languages.
Figure 3. Architecture for the Java reference implementation in Windows
With the Java implementation in Windows, developers get the following benefits:
ActiveX controls will run on ActiveX on the client for multiple operating systems such as the Windows family, Macintosh, and UNIX. Developers can choose to use Java to create one platform-independent ActiveX control binary that runs on multiple platforms or write native versions of ActiveX controls optimized for different target operating systems.
Writing platform-independent ActiveX controls
Developers who are interested in writing a single platform-independent ActiveX control binary that runs on multiple operating systems can do this by writing ActiveX controls using Java development tools such as Microsoft Visual J++. The resulting binary can be placed on a Web site. When an end user with a browser clicks on a page referencing this ActiveX control, the control is downloaded and executed on the end-user's system.
Writing native ActiveX controls
Developers interested in high-performance applications that use specific features on the underlying operating system can write "native" ActiveX controls for different operating systems, such as the Windows family, Macintosh, and UNIX. Developers can then compile these controls to generate different binaries and put these on a Web site. When an end user with a browser clicks on a page referencing an ActiveX control, the appropriate ActiveX control for that platform is downloaded and executed on the end-user system.
Because both "platform-independent" and "native" ActiveX controls will run on Internet Explorer 3.0 as well as on Netscape Navigator, developers can be assured that their ActiveX controls written in different languages will run on most Internet users' systems. Microsoft will make Internet Explorer available on the Macintosh later this year and is looking at ways to make it available on all the major UNIX systems.
Developers can ensure security for end users on the Internet and intranets either by writing untrusted ActiveX controls in Java that are limited to using a safe set of operating system features or by writing trusted ActiveX controls that use the rich features of an underlying operating system. Developers can use Java, Visual C/C+, Visual Basic, or other programming languages and sign trusted ActiveX controls as being safe.
Writing untrusted ActiveX controls
ActiveX controls on Web sites not trusted by an end user are not permitted to use all the features of the operating system. Because these ActiveX controls running on ActiveX are downloaded from a Web site and are limited to using a safe set of operating system features on the end-user system, they cannot compromise the security of the end-user system. ActiveX guarantees that such untrusted ActiveX controls do not use the underlying operating system to compromise security. Developers can write such untrusted ActiveX controls using Java through Java development tools such as Microsoft Visual J++.
Writing trusted ActiveX controls
ActiveX controls that are hosted on Web sites trusted by the user can be downloaded and run on the end-user's system using all the features of the operating system. ActiveX will run trusted applications only if they have not been modified after they leave the trusted Web site, thus providing protection against malicious modification of code during download.
Microsoft is part of a digital signature initiative in the WWW Consortium that allows signed ActiveX controls to be downloaded and run on users' systems. Digital signatures are the online analog of shrink-wrapped applications, where users trust the vendor of the shrink-wrapped application and thereby feel comfortable running that application on their systems. Developers who need to put up trusted ActiveX controls on Web sites can obtain a certificate and sign their code with a digital signature. By affixing a digital signature to the ActiveX control, the developer is guaranteeing that the code is not malicious. When an end user clicks on a page that references a trusted ActiveX control, the signature is downloaded and verified by ActiveX on the client. The verification helps ensure that the code originated from an authorized developer with a valid certificate and that the code has not been modified since the download began. After the verification is complete, the ActiveX control code is enabled so that it runs safely on ActiveX on the client.
The technology for signatures is based on PKCS#7 and X.509 standards. Microsoft is working with VeriSign and over 50 other vendors to deliver this technology to developers. Developers who need to sign their code can get a certificate from one of several certificate-issuing authorities. ActiveX will securely run trusted ActiveX controls that are written in languages such as Java, Visual C++, and Visual Basic. ActiveX will securely run untrusted ActiveX controls written in Java.
Developers who need to respond rapidly to changing business requirements need a quick way to change the behavior of applications for the Internet and intranets. Developers writing ActiveX controls also need a way to programmatically coordinate many ActiveX controls referred to from a Web page. While ActiveX controls are easy to write and modify, they are still compiled and stored in binary form.
Developers can meet these needs by using VB Script to script ActiveX controls. With VB Script, developers can trap events from ActiveX controls, invoke methods, modify properties of ActiveX controls, and more. Because VB Script code is very simple to write and is always maintained in source code form in the Web page itself, it is very easy to modify and is the best way to coordinate activity across ActiveX controls. With VB Script, developers get the following benefits:
Safety: VB Script includes only simple functionality for operations, message boxes, error messages, and so on. It does not allow functionality such as file input/output (I/O) or graphics, which could compromise the security of an end-user's system.
Ease of code development: VB Script is an easy-to-learn scripting language. It is a subset of Microsoft Visual Basic, a language that many developers are already familiar with.
Cross-platform code: Developers can enable their VB Script code to run on multiple operating systems because the VB Script engine will work on ActiveX on the client for the Windows family, the Macintosh, and all major UNIX systems. Microsoft will ship the VB Script engine with Internet Explorer for both Windows and the Macintosh. Microsoft has licensed VB Script technology to other vendors, such as Bristol Technology and Mainsoft, to enable VB Script on all major UNIX systems.
Compatibility: VB Script is compatible with existing investments in Visual Basic because it is a proper subset of Visual Basic for Applications. It leverages existing code and knowledge of Visual Basic.
Open Script: Developers can use VB Script to script ActiveX controls written in languages such as Java, Visual C++, and Visual Basic. Microsoft will make the VB Script engine source code available under license free of cost to browser vendors and application vendors who want to support VB Script in their applications. Microsoft also plans to enable VB Script code to run in other browsers, including Netscape Navigator, through a plug-in.
Microsoft will enable JavaScript scripts to run in Internet Explorer 3.0 through a JavaScript engine. Unlike VB Script, JavaScript code and technology specifications are not available freely, and hence, Microsoft is working on a JavaScript-compatible interpreter that will ship with Internet Explorer.
Developers can insert ActiveX controls into a Web page by using the <OBJECT> tag in the HTML page and referring to the ClassId of the ActiveX control. When a user clicks on a page with an OBJECT tag and a ClassId, ActiveX on the client looks up the client systems registry to find the ActiveX control code referred to with the ClassId. If the relevant ActiveX control is already present on the client system, that code is invoked and executed on the client. If the ActiveX control code is not already present on the client system, it is downloaded from the server, installed on the client after checking for security, and then invoked on the client. ActiveX will also provide versioning support by enabling the option to download the latest version of an ActiveX control. More information on this is available in the ActiveX SDK.
Developers writing ActiveX controls can be assured of a wide end user audience for these controls because ActiveX controls will run on Internet Explorer 3.0, as well as Netscape Navigator (through a Netscape plug-in).
ActiveX server technologies consist of server-side scripting support (Denali), server side transactions (Viper), and message queuing (Falcon). By combining component software, mission critical services, and Internet protocols, Microsoft is delivering a server platform that will enable companies to lower their development costs, leverage their existing systems, and quickly deploy scalable applications for the Internet.
With Microsoft's Internet Information Server, developers can write server side applications for the Internet or intranets. These applications are written using the CGI, enables browser users to send data to the server and run an application on the server and receive data back. Developers can also use Internet Information Server to write PERL scripts that run on the server.
Developers write powerful, high-performance, server-side applications by way of Internet Service API (ISAPI). With ISAPI, developers can write server-side applications using different languages and enable browser users to run those programs on the server. Because ISAPI applications run in the same process as Internet Information Server, good performance is assured. Multiple ISAPI applications can run on the server at the same time using the same thread pool, thus enabling efficient system resource usage. Developers can write ISAPI applications for forms processing, gateways, statistics gathering, custom authentication, data translations, and more. With the Internet Information Server, developers can write server side "filters" by using the ISAPI Filter APIs provided. With such filters, developers can provide custom authentication, encryption, compression, and other features based on filters such as URL addresses.
Denali enables developers to build and run business applications without complex programming.
Viper enables multiple server tasks such as credit check, order entry, and inventory management to execute as a single logical transaction when invoked from a browser. This ensures correct results for complex business applications on the Web.
Network failure for static Web applications often means a page cannot be viewed by a user. Network failure for Internet/intranet applications means that business is not conducted. Falcon guarantees delivery of work between servers despite network failures, as follows:
Developers can choose from several existing development tools, as well as new Java tools, to write applications for ActiveX, thus leveraging their existing knowledge and expertise. For instance, developers can write ActiveX controls using tools such as Microsoft Visual C++, Borland C++, Symantec C++, Microsoft Visual J++, Metrowerks CodeWarrior. Developers will also be able to choose from Java development tools from Borland, Symantec, Microsoft, the Powersoft division of Sybase, and other companies to write applications that run on the Java reference implementation in Windows. With the next release of Microsoft Visual Basic, developers will be able to write ActiveX controls using Visual Basic or modify their existing Visual Basic applications to become ActiveX controls.
Microsoft has developed ActiveX by incorporating extensive customer and industry feedback through its open design process. ActiveX provides choice in hardware, development tools, platforms, networking technologies, and more. Developers can write ActiveX applications that will run across operating systems, and they can choose from many different tools. Webmasters can create content easily from many available authoring tools. Administrators can choose from many different networking technologies and hardware to enable Internet/intranet applications and content on ActiveX.
Microsoft believes that the essential feature of open systems is choice to the customer—choice in hardware, software, networking technologies, price, and performance. In the future, ActiveX technologies will provide a huge choice of applications to customers. More than 1,000 ActiveX controls already exist in the market today and many more are under development. ActiveX is available on many different hardware architectures, for both the server and client sides provided by several hardware companies. ActiveX also includes a wide choice of networking technologies including TCP/IP, HTTP, SMTP, NNTP, and IPX/SPX (see the partial listing of ActiveX supported standards in the table later in this section). With ActiveX, developers can choose from a wide selection of tools to create effective new content and applications for the Internet.
Microsoft has worked with organizations like the Internet Engineering Task Force (IETF) to develop new Internet standards such as DHCP, IP next generation (Ipng), and more.
Microsoft ActiveX technologies are based on both de jure and de facto standards. The following table shows a partial list of standards supported by Microsoft ActiveX.
Microsoft ActiveX supported standards
| Area | Standards and Technologies in ActiveX (partial listing) |
| Networking | TCP/IP, IPX/SPX, PPP, SLIP, DNS, RIP, PPTP, DHCP, WINS, IPng, SSL |
| Web | HTTP, HTML, VRML |
| Communication | RTP, T.120, T.127, H.323, RSVP |
| Messaging | SMTP, X.400, MIME, POP3 |
| Databases | ODBC (ISO 9942), SQL |
| Programming Languages | ANSI C (ISO 9899), ANSI C++, Java, Basic |
| Directory | X.500 |
| Miscellaneous | FTP, Gopher, Telnet |
With ActiveX, developers can create ActiveX controls or Java applets using one of many easy-to-use development tools. Because over 1,000 shrink-wrapped ActiveX controls available in the market today can be scripted using VB Script or JavaScript, MIS managers can develop software quickly by leveraging existing shrink-wrapped ActiveX controls. With the next release of Visual Basic, developers can create ActiveX controls very easily by using the graphical Visual Basic development environment.
Further information on topics related to this white paper can be obtained through these sources:
Other material for developers is available through the following Microsoft sources:
For additional developer information, send electronic mail to devwire@microsoft.nwnet.com with the words "Subscribe DevWire" in the message body.