How do you isolate validation and authorization logic in Laravel Form Request classes?

Short answer

Use a dedicated class with authorize() to check user permissions and rules() to define validation rules; it automatically returns validation errors with status 422 without reaching the controller.

Explanation

Instead of filling Controller methods with $request->validate() calls, Form Requests provide clean, specialized classes. Inject the class as a method parameter; Laravel calls authorize() first (returning 403 Forbidden if it returns false), then applies rules(). If validation fails, it immediately returns a JSON response with status 422 and details about the invalid fields.

Code example

class StorePostRequest extends FormRequest {
    public function authorize(): bool {
        return $this->user()->can('create', Post::class);
    }
    public function rules(): array {
        return [
            'title' => ['required', 'string', 'max:255'],
            'body' => ['required'],
        ];
    }
}

Common mistakes

• Leaving authorize() at its default false return value, blocking all users with status 403.

Follow-up questions

• How do you design centralized, consistent error handling for Laravel API responses?

Sources

• Laravel docs — Form Request Validation