From 83da86a3588e147a4933f31dfc4bcdfd6f71710b Mon Sep 17 00:00:00 2001
From: Rob Winch <362503+rwinch@users.noreply.github.com>
Date: Mon, 6 Oct 2025 09:33:49 -0500
Subject: [PATCH] DefaultLoginPageGeneratingFilter uses List

This fixes an ordering problem with query parameters of the tests.

Issue gh-18002
---
 .../authentication/ui/DefaultLoginPageGeneratingFilter.java    | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java
index d9da2cb181..0a367da71a 100644
--- a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java
+++ b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java
@@ -21,7 +21,6 @@ import java.nio.charset.StandardCharsets;
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.stream.Collectors;
@@ -92,7 +91,7 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean {
 
 	private final String factorReasonParameter = "factor.reason";
 
-	private final Set<String> allowedParameters = Set.of(this.factorTypeParameter, this.factorReasonParameter);
+	private final List<String> allowedParameters = List.of(this.factorTypeParameter, this.factorReasonParameter);
 
 	@SuppressWarnings("NullAway.Init")
 	private Map<String, String> oauth2AuthenticationUrlToClientName;