ASP.NET Core custom login setup

1. Is this secure enough?

Generally roll-your-own security is a bad idea because it won't have faced as much scrutiny as an industry standard like Identity Framework. If your application is not life-or-death then maybe this is enough.

2. Should we generate a random salt?

Yes, salts should always be random. One reason is that when a user changes their password, back to a previous password, if the salt is constant too, then you would get the same hash again, which could be detected.
Another reason is that we don't want the salts to be predictable or sequential. That would make it easier for hackers to generate rainbow tables.

If stored in the customer table how would it be different to the internal (20 character) customer ID?

I suppose if your customer ID is already a long random guid then that might not matter exactly, but best to play it safe, with cryptographically random disposable salts. Look at solutions which use RNGCryptoServiceProvider to generate the salt.

Is there a way for the server session cookie to be spoofed?

I don't think a hacker could create a new session just by spoofing. They would need the username & password.
But they could highjack an existing session using Cross-Site Request Forgery.

Should we store a hash in the session which we also check on each action?

I don't think that would help. Your _session.SetString("LoggedIn", "true") value is already stored on the server and is completely inaccessible from the client. The client only has access to the session cookie, which is just a random id. If that LoggedIn session value is true, then a hash wouldn't make it extra true.

Last year I made a custom IUserPasswordStore for a customer. This solution involved Microsoft.AspNetCore.Identity.UserManager which handles password hashing behind the scenes, no custom password handling required. You will be responsible for storing hashed password in db along with other user properties.

I cannot publish the code in its entirety, it is not my property, but I can sketch up the main parts.

First, we need the IdentityUser:

public class AppIdentityUser : IdentityUser<int>
{
    public string Name { get; set; }
}

Then an implementation if IUserPasswordStore

public class UserPasswordStore : IUserPasswordStore<AppIdentityUser>
{
    private readonly IUserRepo _userRepo; // your custom user repository
    private readonly IdentityErrorDescriber _identityErrorDescriber;

    public UserPasswordStore(IUserRepo userRepo, IdentityErrorDescriber identityErrorDescriber)
    {
        _userRepo = userRepo;
        _identityErrorDescriber = identityErrorDescriber;
    }

    public Task<IdentityResult> CreateAsync(AppIdentityUser user, CancellationToken cancellationToken = default)
    {
        cancellationToken.ThrowIfCancellationRequested();
        if (user == null)
        {
            throw new ArgumentNullException(nameof(user));
        }

        // if email exists, fail
        if (_userRepo.GetByEmailAddress(user.Email) != null)
        {
            return Task.FromResult(IdentityResult.Failed(_identityErrorDescriber.DuplicateEmail(user.Email)));
        }

        // ... convert AppIdentityUser to model class
        // 
        _userRepo.Save(userModel);
        return Task.FromResult(IdentityResult.Success);
    }

    ... implementation of the rest of IUserPasswordStore<AppIdentityUser> comes here
}

Inject this into code for identity user CRUD-operations, e.g. user management controller:

UserManager<AppIdentityUser>

Sample code for changing password (sorry for the nesting)

        var result = await _userManager.RemovePasswordAsync(identityUser);
        if (result.Succeeded)
        {
            result = await _userManager.AddPasswordAsync(identityUser, model.Password);
            if (result.Succeeded)
            {
                var updateResult = await _userManager.UpdateAsync(identityUser);
                if (updateResult.Succeeded)
                {
                   ... do something
                }
            }
        }

Inject this into LoginController:

SignInManager<AppIdentityUser>

We also need an implementation of

IRoleStore<IdentityRole>. 

If authorization is not required, leave all methods empty.

In Startup#ConfigureServices:

services.AddIdentity<AppIdentityUser, IdentityRole>().AddDefaultTokenProviders();
services.AddTransient<IUserStore<AppIdentityUser>, UserPasswordStore>();
services.AddTransient<IRoleStore<IdentityRole>, RoleStore>();
services.Configure<CookiePolicyOptions>(options => ...
services.Configure<IdentityOptions>(options => ...
services.ConfigureApplicationCookie(options => ...

In Startup#Configure:

app.UseCookiePolicy();
app.UseAuthentication();
app.UseAuthorization();

See also https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-custom-storage-providers?view=aspnetcore-3.1