Consider using form requests

They're a great place to hide complex validation logic.

But beware of exactly that — hiding things. When your validation logic is simple, there's nothing wrong with doing it in the controller. Moving it to a form request makes it less explicit