Matt Molyneaux

For completeness, could you tell us what version of django-otp-yubikey you have installed too? Could you also confirm that you've followed the instructions for YubiKey setup: https://django-two-factor-auth.readthedocs.io/en/1.8.0/installation.html#yubikey-setup

Could you provide the following: * Browser and version * Python version * Django version * django-otp version * django-two-factor-auth version

What's `SESSION_COOKIE_DOMAIN` set to? IIRC, Django's session cookies have `HostOnly` set on them so you'll need to make sure `SESSION_COOKIE_DOMAIN` has a value like `.xyz.com` (note the `.` at the...

Does it work if you make only the username/password form have a recaptcha field?

I'm not sure what you mean by that. As I read it, you'll have a recaptcha on every step which is simply unnecessary IMO.

It's possible, but you'd have to write your own login and setup views

That might be worth doing as it's not the only issue reported that was caused by this sort of misconfiguration: https://github.com/Bouke/django-two-factor-auth/issues/291

@ronnievdc that's by design and this bug pre-dates that feature by about a year.

Are there any other URLs that might be loaded that could be causing this issue for you?

Some more information would be helpful!