It's FAA regulations, not exactly a law but it pretty much does carry the force of law since you can be arrested and charged for failing to comply with FAA regulations.

Federal law requires compliance with FAA regulations, FAA regulations require people to wear masks when traveling via airplane/airport. So technically it is correct to say that federal law requires that masks be worn even though there's no federal law requiring masks be worn.