Just before dawn on the morning of September 23, the US began air strikes in Syria, targeting members of the terrorist groups ISIS and Khorasan. This immediately raised a question that could loom over the US action for some time: Are those strikes legal under international law?
The baseline rule is that countries can't bomb each other's territory, because that would be a violation of the target country's sovereignty. There is a limited set of exceptions to that rule, and a bombing campaign has to fall within one of those exceptions to be legal. (It also needs to satisfy all other requirements of domestic and international law, of course.)
This may seem like an abstract question, but the answer matters. America and its allies rely on these principles of sovereignty to conduct their foreign policy. For instance, the US is currently pressuring Russia to withdraw from Ukraine on the grounds that Russia's actions there violate Ukrainian sovereignty. International law is also incorporated into US federal law, so the legality of the Syrian bombing under US law is, by extension, at issue here.
Because the Obama administration doesn't have authorization for the air strikes from either the UN or Syria, it's basing America's legal justification on principles of self-defense. Their legal argument for the strikes against ISIS is just okay — it's not one you'd want to rely on if you had any better options, but it'll probably do in a pinch. However, the justification for the strikes against Khorasan is much weaker, and those strikes may violate international law.
No permission from Syria
The US can't claim the simplest exception to the no-bombing-other-countries'-territory rule: permission from the country being bombed. That exception does apply to the US military operations in Iraq, because the Iraqi government invited the US to take part in the war against ISIS there. But it doesn't apply in Syria, because the Assad regime has done no such thing.
While Assad seems to be tacitly welcoming the strikes, even playing up the (likely false) idea that he is coordinating with the US for the strikes, and the US government did notify the regime before launching the attacks, that is not the same thing in legal terms as official permission.
No permission from the UN Security Council
The second exception is if the UN Security Council grants permission for the bombing, under its Chapter VII authority to combat "threats to international peace and security." That hasn't happened here either, and it probably isn't going to. The reason is Russia.
Russia is a strong ally of the Assad regime, and has consistently opposed any outside military intervention in Syria. As a permanent member of the Security Council, Russia has the authority to veto any resolution, which means it can prevent any Chapter VII authorization for the use of force. Indeed, Russia has already condemned the air strikes against Syria, saying that they violate international law, and that they will "exacerbate tensions and further destabilize the situation."
The US legal argument is based on "collective self-defense"
In a letter to UN Secretary-General Ban Ki Moon, US Ambassador to the UN Samantha Power asserts that the strikes are legal under the customary international law principle of self-defense, based on two different arguments.
First, her letter justifies the US action against ISIS on the grounds of collective self-defense: asserting that ISIS is attacking Iraq from safe havens in Syria, that the Syrian government is "unable or unwilling" to eradicate them, and that Iraq has asked the United States to lead an international effort to combat that problem.
Second, Power's letter justifies US action against the Khorasan terrorist organization, which it describes as "al-Qaida elements in Syria," on the basis of preemptive self-defense: it describes the military action as necessary to "address terrorist threats that they pose to the United States and our partners and allies."
The implicit argument here — that states can rely on collective self-defense to defend themselves against threats from non-state actors like ISIS and Khorasan — currently has uncertain status in international law. It's not a crazy case to make, but it's not a home run either.
Traditionally, collective self-defense has only applied to threats from state actors. However, because this is a customary law argument, its specifics are derived from patterns of state practice, not just written treaties or court decisions, and those can change over time. As law professor Jens David Ohlin points out, there are indications that state practice is trending towards support for this type of self-defense. So the response to the US action in Syria may end up crystallizing the rule as applying to non-state actors like ISIS. But that hasn't happened yet.
The argument about Khorasan is much more of a stretch. Power's letter indicates that the US is acting preemptively against the threat that Khorasan might attack the US or its allies in the future. According to the letter, the US's legal justification for the strikes on Khorasan is that the action is intended "to address terrorist threats that they pose to the United States and our partners and allies." But pre-emptive self defense is a doctrine with very little support among the community of nations, and pre-emptive collective self-defense against a non-state actor is an even weaker legal justification.
So, in sum: the US's legal justification for bombing ISIS in Syria goes beyond what established law allows, but there is a decent chance that the law will catch up quickly, so that probably won't matter very much in the end. But its arguments for the legality of bombing Khorasan are much weaker, and those strikes may violate international law.