ASP.NET Core doesn't have the same request validation feature as it was in ASP.NET. Here are team responses in GH issue:
RequestValidation was always rather porous, and eventually we came to the realisation that validate should be an app concern, because what's validate for one application isn't valid for another,
and
We have no plans to ever build a request validation middleware like what existed in System.Web.
Also useful: SO Enable asp.net core request validation. If shortly, Model validation should be used instead.