CASL is an isomorphic authorization JavaScript library that restricts what resources a given user is allowed to access.
CASL solves the problem of managing permissions consistently across frontend and backend environments. It works by defining abilities—rules that specify what actions a user can perform on particular resources. The library operates on a flexible model that scales from simple claim-based authorization to fully featured subject and attribute-based access control. Rules are declarative, making them serializable and shareable between UI components, API services, and database queries.
CASL suits projects that need authorization logic spanning multiple layers of an application. It is particularly valuable when you want to avoid duplicating permission logic across frontend frameworks and backend services. The core library is lightweight at 6KB minified and gzipped, and the project provides complementary packages for integration with major frameworks including React, Angular, and Vue, as well as ORMs like Mongoose and Prisma. The library is TypeScript-based, offering type safety for authorization rules.
The project maintains active engagement with its community through a dedicated support chat and documentation site. Development activity shows consistent attention to ecosystem integration, with maintained packages for multiple frontend frameworks and backend ORMs. The maintainers prioritize backward compatibility and incremental adoptability, allowing teams to start with simple permission schemes and evolve toward more complex authorization models as needs grow.
