TOPIC
The confirmed rule has one specific, easy-to-miss requirement: the confirmation field must be named exactly {field}_confirmation, or the rule silently never matches anything.
The native Constraint Validation API — setCustomValidity() specifically — lets a browser show its own built-in validation message for a custom check like password matching, without a framework.
A plain unique rule breaks in two common situations — editing a record without triggering a false "already taken" error against itself, and soft-deleted rows still counting as taken.
The dot-notation syntax for validating each item in an array field, and the * wildcard for a variable-length list — like a form that lets someone add multiple items dynamically.
The mimes, max, and dimensions validation rules for file uploads, and why validating the file extension alone is not a real security check.
Validators.required and friends cover the basics — the parts that actually trip people up are writing a custom validator function and validating one field against another.
required, min/max, email, and unique — the validation rules that cover most real forms, plus the Form Request pattern for keeping validation out of the controller.
