What are Form Request classes?

Question

Accepted Answer

**Form Request** classes are custom request classes that **encapsulate validation (and authorization) logic** for a specific request. They move validation rules out of controllers into dedicated, reusable classes — keeping controllers thin and validation organized.

## Creating and using a Form Request

```php
<?php
// php artisan make:request StoreUserRequest
class StoreUserRequest extends FormRequest {
    public function authorize(): bool {
        return $this->user()->can('create', User::class);   // AUTHORIZATION check
    }

public function rules(): array {
        return [                                              // VALIDATION rules
            'name' => 'required|string|max:100',
            'email' => 'required|email|unique:users',
            'password' => 'required|min:8|confirmed',
        ];
    }

public function messages(): array {
        return ['email.unique' => 'That email is already taken.'];   // custom messages
    }
}
```

```php
// type-hint the Form Request in the controller — validation runs AUTOMATICALLY
public function store(StoreUserRequest $request) {
    // if we reach here, validation AND authorization already PASSED
    User::create($request->validated());   // get the validated data
}
```

When you type-hint a Form Request in a controller method, Laravel **automatically runs its authorization and validation before the method executes** — if either fails, the request is rejected (403 for authorization, 422/redirect for validation) and your method never runs. So inside the method, you know the data is valid and the action is authorized.

## The benefits

```text
✓ Thin controllers — validation/authorization logic lives in the Form Request, not the controller
✓ Reusable — use the same request class across multiple endpoints
✓ Organized — rules, messages, and authorization for a request are in one place
✓ Combines validation AND authorization — both checked automatically before the controller
✓ Access prepared/validated data cleanly via $request->validated()
```

## Why it matters

Form Request classes are an important Laravel best practice for organizing validation and authorization cleanly — they're the recommended approach for anything beyond trivial validation, so understanding them is valuable for writing maintainable Laravel applications.

Their key benefit is keeping **controllers thin**: by moving validation rules and authorization logic into a dedicated class (that Laravel runs automatically before the controller method), the controller stays focused on its core logic, with the assurance that the data is already validated and the action authorized when it executes.

This separation makes code more **organized** (all rules, custom messages, and authorization for a request in one cohesive place), **reusable** (the same Form Request can be used across endpoints), and cleaner.

The automatic combination of **validation and authorization** in one class — both checked before the controller runs, rejecting invalid or unauthorized requests automatically — is elegant and reduces boilerplate.

Understanding Form Requests, how they run automatically, and the benefits of extracting validation/authorization from controllers reflects mature Laravel practice and is important for building well-structured applications, since validation and authorization are ubiquitous concerns and Form Requests are Laravel's clean, idiomatic way to handle them for non-trivial cases — a hallmark of professional, maintainable Laravel code.