An isomorphic JavaScript authorization library that restricts user access to resources with incremental adoption and scalability.
CASL is an isomorphic authorization library for JavaScript applications that manages what resources a user can access. It enables developers to define and enforce permissions consistently across frontend components, backend APIs, and database queries, supporting both simple claim-based and complex attribute-based authorization models. The library is designed to be incrementally adoptable, allowing developers to start with simple rules and scale to complex authorization as application needs grow.
Full-stack JavaScript developers building applications that require consistent authorization logic across the frontend and backend, particularly those using frameworks like React, Vue, Angular, or Aurelia, and ORMs like Mongoose or Prisma.
Developers choose CASL for its isomorphic nature, allowing seamless permission sharing between UI and API layers, and its incremental adoptability that scales from simple to complex authorization without rewriting logic. Its small core size (6KB minified and gzipped), TypeScript support, and declarative rule serialization provide a flexible and type-safe alternative to manual authorization checks.
CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Allows seamless permission sharing between frontend and backend with official integrations for React, Vue, Angular, and more, reducing logic duplication and bugs across the stack.
Scales from simple claim-based to complex attribute-based authorization, enabling teams to start with basic rules and evolve without rewriting, as highlighted in its design philosophy.
Built with TypeScript from the ground up, providing strong type safety, autocompletion, and a better developer experience for modern JavaScript projects.
Core library is only 6KB minified and gzipped and tree-shakeable, ensuring low overhead for frontend performance, especially with modular packages.
Uses MongoDB query operators for conditions, which can be confusing for developers unfamiliar with MongoDB and limits flexibility for other database query paradigms without custom adapters.
Deep integrations are limited to specific ORMs (Mongoose, Prisma) and frameworks; using other technologies requires manual implementation, increasing maintenance effort.
Advanced features like custom condition matching or complex rule compositions require a deep understanding of CASL's APIs, which can be overwhelming for simpler use cases.