The content security policy by itself does not 100% protect a site from attacks but it does help to diminish the possibility of a cross site scripting attack. A CSP header instructs the browser to ...

Take advantage of security headers in ASP.NET Core MVC 5 to protect your website against cross-site scripting, code injection, clickjacking, and other attacks.

This article talks about how you can read request headers in ASP.NET Core 5 MVC, using the RequestHeaders class pertaining to Microsoft.AspNetCore.Http.Headers namespace.