Is it possible to do Flask authentication this way?

Question

Flask

On a certain page, the client enters a name and password.
When you click send data for verification, the Client first receives some random key via AJAX (string that Flask stuffs into session['token']) and this key is hashed through JS sha256: username+password+randomkey.
The resulting hash is submitted by the form and Flask checks-scans the user table for a combination match:

hashlib.sha256(user+pass+session['token']).hexdigest()

with the received code (hash)
If any record matches, it means the correct client. We create
session['login']=True
and on all pages (route) we check:

if session.get('login') !=True: return redirect(url_for('login'))

Will such authorization be secure?

Answer 1

I'm more confused by the code
Is it reliable?