Any data that enters your system from outside a trust boundary should be treated as untrusted until proven otherwise. That includes form fields, API payloads, file uploads, headers, cookies, queue ...
ASP.NET Core 2.3 web dev support on its way out Microsoft will stop providing security patches, bug fixes, and technical support for ASP.NET Core 2.3 on April 7, 2027.