Is there any major flaw in using TOTP in a way where the server sends its time to the client when the client requests to log in? The advantage of this is the client's time does not have to be set correctly, as it uses the time provided by the server. The disadvantage is the client must be online to generate the password, but in this case, since it's logging into a webservice, it has to be online anyway so this is not a disadvantage for me.
To elaborate my proposal:
HTTPS JS fetch Server <-------> Client (browser) <----------> local python webservice