# Validate an Inertia form with a form request

> Move Inertia form rules into a form request and pass validated() to the model. authorize() still runs.

- URL: https://laravel-vuejs.space/laravel-form-request-inertia
- Author: Anass Ez-zouaine (https://laravel-vuejs.space/author/anass-ez-zouaine)
- Published: 2026-10-11
- Topics: Laravel, VueJs, Inertia

People searching “Laravel form request Inertia” want the rules off the controller. The Vue page does not change. It still posts `title` and reads `form.errors.title`, as in the [CRUD guide](https://laravel-vuejs.space/laravel-inertia-vue-crud).

> **TL;DR**
>
> -   Move Inertia form rules into a form request and pass validated() to the model.
> -   authorize() still runs.
> -   Do not `return true` from `authorize()` on a request that updates someone else’s post.
>
> **Who it's for:** Laravel + Vue developers on Inertia
>
> **Applies to:** Laravel 13 · Inertia 3 · Vue 3

## The fix

```shell
php artisan make:request StorePostRequest
```

```php
public function authorize(): bool
{
    return $this->user() !== null;
}

public function rules(): array
{
    return [
        'title' => ['required', 'string', 'max:120'],
    ];
}
```

```php
public function store(StorePostRequest $request): RedirectResponse
{
    Post::create([
        'title' => $request->validated('title'),
        'user_id' => $request->user()->id,
    ]);

    return to_route('posts.index');
}
```

`$request->validated()` is the only array you should persist. A key that is not in `rules()` is dropped, which is the point.

## What to avoid

> **Gotcha**
>
> Do not `return true` from `authorize()` on a request that updates someone else’s post. That method is a gate. The owner check belongs in a [policy](https://laravel-vuejs.space/laravel-vue-policies), and `authorize()` can call it.

## FAQ

**Q: How do I validate an Inertia form with a form request?**

Move Inertia form rules into a form request and pass validated() to the model. authorize() still runs.

**Q: What goes wrong with Laravel form request Inertia?**

Many developers want the rules off the controller. Do not `return true` from `authorize()` on a request that updates someone else's post.