Laravel Form Requests vs Validator Façade — A Comparison

Laravel gives you two main ways to validate request input: form request classes, and the Validator façade in your controllers. Both are official, both work, and most codebases end up with a mix of them. That is usually a mistake.

Form requests

A form request is a class that extends FormRequest and defines rules() and authorize() methods. You type-hint it on the controller method and Laravel runs validation before your code executes. Validation failures throw an exception that Laravel turns into a 422 response automatically.

Strengths: keeps controllers thin, makes rules reusable, and the FormRequest is the obvious place to put authorization logic that depends on the request body.

Validator façade

Validator::make($data, $rules)->validate() lets you validate inline. It is concise for one-off endpoints, especially when the rules are computed dynamically based on what is being requested.

Strengths: lower ceremony for simple cases, and the rules can vary per call without making three different request classes.

A simple convention

Use form requests for any endpoint with non-trivial validation, especially ones with conditional rules or related authorization. Use the Validator façade only for tiny endpoints where the rules fit in three lines and will not grow. The mistake is using the Validator façade everywhere because it is one less file — six months later, all the validation lives in controllers and the rules are scattered.

Pick a default and stick with it. Consistency across the codebase matters more than choosing the theoretically best option.