Fix RFC 7239 Forwarded header relay for entries without for

spring-cloud-gateway-server-webflux/src/main/java/org/springframework/cloud/gateway/filter/headers/ForwardedHeadersFilter.java

@@ -164,9 +164,10 @@ public HttpHeaders filter(HttpHeaders input, ServerWebExchange exchange) {
 		List<Forwarded> forwardeds = parse(forwardedHeaders);
 
 		for (Forwarded f : forwardeds) {
-			// only add if "for" value matches trustedProxies
 			String forValue = f.get("for");
-			if (forValue != null && trustedProxies.isTrusted(forValue)) {
+			// Preserve valid Forwarded entries without a `for` parameter.
+			// Per RFC 7239, all Forwarded parameters are optional.
+			if (forValue == null || trustedProxies.isTrusted(forValue)) {
 				updated.add(FORWARDED_HEADER, f.toHeaderValue());
 			}
 		}

spring-cloud-gateway-server-webflux/src/test/java/org/springframework/cloud/gateway/filter/headers/ForwardedHeadersFilterTests.java

@@ -120,6 +120,25 @@ public void forwardedHeaderExists() throws UnknownHostException {
 		});
 	}
 
+	@Test
+	public void forwardedHeaderWithoutForIsPreserved() throws UnknownHostException {
+		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost/get")
+			.remoteAddress(new InetSocketAddress(InetAddress.getByName("10.0.0.1"), 80))
+			.header(FORWARDED_HEADER, "proto=http;host=example.com, for=23.45.67.89")
+			.build();
+
+		ForwardedHeadersFilter filter = new ForwardedHeadersFilter(".*");
+
+		HttpHeaders headers = filter.filter(request.getHeaders(), MockServerWebExchange.from(request));
+
+		assertThat(headers.get(FORWARDED_HEADER)).hasSize(3);
+
+		List<Forwarded> forwardeds = ForwardedHeadersFilter.parse(headers.get(FORWARDED_HEADER));
+
+		assertThat(forwardeds)
+			.anyMatch(forwarded -> "example.com".equals(forwarded.get("host")) && forwarded.get("for") == null);
+	}
+
 	@Test
 	public void noHostHeader() throws UnknownHostException {
 		MockServerHttpRequest request = MockServerHttpRequest.get("http://localhost/get")

spring-cloud-gateway-server-webmvc/src/main/java/org/springframework/cloud/gateway/server/mvc/filter/ForwardedRequestHeadersFilter.java

@@ -176,8 +176,8 @@ public HttpHeaders apply(HttpHeaders input, ServerRequest request) {
 			List<Forwarded> forwardeds = parse(forwardedHeader);
 
 			for (Forwarded f : forwardeds) {
-				// only add if "for" value matches trustedProxies
-				if (trustedProxies.isTrusted(f.get("for"))) {
+				// preserve existing forwarded entries that do not contain a "for" value
+				if (f.get("for") == null || trustedProxies.isTrusted(f.get("for"))) {
 					updated.add(FORWARDED_HEADER, f.toHeaderValue());
 				}
 			}

spring-cloud-gateway-server-webmvc/src/test/java/org/springframework/cloud/gateway/server/mvc/filter/ForwardedRequestHeadersFilterTests.java

@@ -180,6 +180,27 @@ public void forwardedHeaderExists() {
 		});
 	}
 
+	@Test
+	public void forwardedHeaderWithoutForIsPreserved() {
+		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/get")
+			.remoteAddress("10.0.0.1:80")
+			.header(FORWARDED_HEADER, "proto=http;host=example.com, for=23.45.67.89")
+			.buildRequest(null);
+		servletRequest.setRemoteHost("10.0.0.1");
+		ServerRequest request = ServerRequest.create(servletRequest, Collections.emptyList());
+
+		ForwardedRequestHeadersFilter filter = new ForwardedRequestHeadersFilter(".*");
+
+		HttpHeaders headers = filter.apply(request.headers().asHttpHeaders(), request);
+
+		assertThat(headers.get(FORWARDED_HEADER)).hasSize(3);
+
+		List<Forwarded> forwardeds = ForwardedRequestHeadersFilter.parse(headers.get(FORWARDED_HEADER));
+
+		assertThat(forwardeds)
+			.anyMatch(forwarded -> "example.com".equals(forwarded.get("host")) && forwarded.get("for") == null);
+	}
+
 	@Test
 	public void noHostHeader() throws UnknownHostException {
 		MockHttpServletRequest servletRequest = MockMvcRequestBuilders.get("http://localhost/get")