title: Enable asp.net core request validation
body: <p>Am I missing something or asp.net core allows to post script tag in user text fields? In Previous versions of asp.net mvc I needed to allow it by [AllowHtml] attribute.</p>
  
  <p>Is there a way how enable validation agains potentially dangerous values?</p>
  
  <p>I'm free to submit value like</p>
  
  <pre><code>&lt;script src='http://test.com/hack.js'&gt;&lt;/script&gt;
  </code></pre>
  
  <p>during form post.</p>
  
  <p>Model:</p>
  
  <pre><code>using System.ComponentModel.DataAnnotations;
  
  namespace Test.Models
  {
      public class TestModel
      {
          [MaxLength(500)]
          public string Content { get; set; }
      }
  }
  </code></pre>
  
  <p>Controller:</p>
  
  <pre><code>using Microsoft.AspNetCore.Mvc;
  using Test.Models;
  
  namespace Test.Controllers
  {
      public class HomeController : Controller
      {
          public IActionResult Index()
          {
              var model = new TestModel { Content = "Test" };
              return View();
          }
  
          [HttpPost]
          public IActionResult Index(TestModel model)
          {
              if(!ModelState.IsValid)
                  return View(model);
  
              return Content("Success");
          }
      }
  }
  </code></pre>
  
  <p>View:</p>
  
  <pre><code>@model TestModel
  
  &lt;form asp-action="Index" asp-controller="Home" method="post"&gt;
      &lt;div asp-validation-summary="All"&gt;&lt;/div&gt;
          &lt;label asp-for="Content"&gt;Content&lt;strong&gt;*&lt;/strong&gt;&lt;/label&gt;
          &lt;span asp-validation-for="Content"&gt;&lt;/span&gt;
          &lt;input asp-for="Content" type="text" /&gt;
      &lt;/div&gt;
  &lt;/form&gt;
  </code></pre>