How to create a secure login system in ASP.NET API?

[HttpPost]
        public async Task<IActionResult> Login([FromForm]string username, [FromForm] string password)
        {
            string Hpassword = String2Hash.GetHashString(password);
            var user = await _sqlServerContext.Users.FirstOrDefaultAsync(x => x.Username == username && x.Password == Hpassword);
            if (user != null)
            {
                HttpContext.Session.SetString("username", user.Username);
                HttpContext.Session.SetString("IsActive", user.IsActive.ToString());
                HttpContext.Session.SetString("IsLocked", user.IsLocked.ToString());
                HttpContext.Session.SetString("UserRole", user.UserRole);
                HttpContext.Session.SetString("CanAccessFiles", user.CanAccessFiles.ToString());
                HttpContext.Session.SetString("CanAccessMessages", user.CanAccessMessages.ToString());
                HttpContext.Session.SetString("CanAccessNotification", user.CanAccessNotifications.ToString());
                HttpContext.Session.SetString("CanAccessPmDatabase", user.CanAccessPmDatabase.ToString());


                return Ok("valid");
            }
            return NotFound("invalid");
        }