People searching “Laravel form request Inertia” want the rules off the controller. The Vue page does not change. It still posts title and reads form.errors.title, as in the CRUD guide.
TL;DR
- Move Inertia form rules into a form request and pass validated() to the model.
- authorize() still runs.
- Do not
return truefromauthorize()on a request that updates someone else’s post.
The fix#
shell
php artisan make:request StorePostRequestphp
public function authorize(): bool
{
return $this->user() !== null;
}
public function rules(): array
{
return [
'title' => ['required', 'string', 'max:120'],
];
}php
public function store(StorePostRequest $request): RedirectResponse
{
Post::create([
'title' => $request->validated('title'),
'user_id' => $request->user()->id,
]);
return to_route('posts.index');
}$request->validated() is the only array you should persist. A key that is not in rules() is dropped, which is the point.
What to avoid#
Gotcha
Do not return true from authorize() on a request that updates someone else’s post. That method is a gate. The owner check belongs in a policy, and authorize() can call it.
FAQ#
How do I validate an Inertia form with a form request?
Move Inertia form rules into a form request and pass validated() to the model. authorize() still runs.
What goes wrong with Laravel form request Inertia?
Many developers want the rules off the controller. Do not return true from authorize() on a request that updates someone else's post.
