Is there any major flaw in using TOTP in a way where the server sends its time to the client when the client requests to log in? The advantage of this is the client's time does not have to be set correctly, as it uses the time provided by the server. The disadvantage is the client must be online to generate the password, but in this case, since it's logging into a webservice, it has to be online anyway so this is not a disadvantage for me.
To elaborate my proposal:
HTTPS JS fetch
Server <-------> Client (browser) <----------> local python webservice
Dealing with a client logging into a webservice, via HTTPS. The client (browser) navigates to the login webpage. The server time is embedded in a JavaScript variable of the webpage. The client JS then calls a locally running python app that is a webservice, and passes it the server time. The locally running app has access to the secret key, and it uses its secret key along with the server time to generate the password, which it returns to the client browser, the client then posts the login credentials to the server.