Fix broken AS4 links (#6851)

docs/source/security/cors.mdx

@@ -204,7 +204,7 @@ To avoid CSRF and XS-Search attacks, GraphQL servers should refuse to execute an
 
 The most important rule for whether or not a request is ["simple"](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests) is whether it tries to set arbitrary HTTP request headers. Any request that sets the `Content-Type` header to `application/json` (or anything other than a list of three particular values) cannot be a simple request, and thus it must be preflighted. Because all `POST` requests recognized by Apollo Server must contain a `Content-Type` header specifying `application/json`, we can be confident that they are not simple requests and that if they come from a browser, they have been preflighted.
 
-However, Apollo Server also handles [`GET` requests](../requests#get-requests). `GET` requests do not require a `Content-Type` header, so they can potentially be simple requests. So how can we ensure that we only execute `GET` requests that are _not_ simple requests? If we require the request to include an HTTP header that is never set automatically by the browser, then that is sufficient: requests that set HTTP headers other than the handful defined in the spec must be preflighted.
+However, Apollo Server also handles [`GET` requests](../workflow/requests#get-requests). `GET` requests do not require a `Content-Type` header, so they can potentially be simple requests. So how can we ensure that we only execute `GET` requests that are _not_ simple requests? If we require the request to include an HTTP header that is never set automatically by the browser, then that is sufficient: requests that set HTTP headers other than the handful defined in the spec must be preflighted.
 
 By default, Apollo Server 4 has a CSRF prevention feature enabled. This means your server only executes GraphQL operations if at least one of the following conditions is true:
 

docs/source/testing/testing.mdx

@@ -66,7 +66,7 @@ To expand on the example above, here's a full integration test being run against
 
 <!-- TODO(AS4) remove once RESTDataSource is up and ready -->
 
-> ⚠️ The Apollo Server 4 alpha doesn't currently support using [`RESTDataSource`](./migration#datasources), a class commonly used to fetch data from a database or a REST API. This feature is in active development, but in the meantime the below code snippet doesn't work as described.
+> ⚠️ The Apollo Server 4 alpha doesn't currently support using [`RESTDataSource`](../migration#datasources), a class commonly used to fetch data from a database or a REST API. This feature is in active development, but in the meantime the below code snippet doesn't work as described.
 
 ```ts title="integration.test.ts"
 it('fetches single launch', async () => {

docs/source/workflow/requests.md

@@ -71,7 +71,7 @@ If you send a batched request, Apollo Server responds with a corresponding array
 
 Apollo Server also accepts `GET` requests for queries (but not mutations). With a `GET` request, query details (`query`, `operationName`, `variables`) are provided as URL query parameters. The `variables` option is a URL-escaped JSON object.
 
-> Sending queries as `GET` requests can help with [CDN caching](./performance/caching/#caching-with-a-cdn).
+> Sending queries as `GET` requests can help with [CDN caching](../performance/caching/#caching-with-a-cdn).
 
 Here's the same query from [POST requests](#post-requests) formatted for a `curl` `GET` request:
 
@@ -80,9 +80,9 @@ curl --request GET \
   https://rover.apollo.dev/quickstart/products/graphql?query=query%20GetBestSellers%28%24category%3A%20ProductCategory%29%7BbestSellers%28category%3A%20%24category%29%7Btitle%7D%7D&operationName=GetBestSellers&variables=%7B%22category%22%3A%22BOOKS%22%7D
 ```
 
-Unlike with `POST` requests, `GET` requests do not require a `Content-Type` header. However, if you have Apollo Server 4's default [CSRF prevention](./security/cors#preventing-cross-site-request-forgery-csrf) feature enabled, `GET` requests that don't contain a `Content-Type` header must contain one of the following:
+Unlike with `POST` requests, `GET` requests do not require a `Content-Type` header. However, if you have Apollo Server 4's default [CSRF prevention](../security/cors#preventing-cross-site-request-forgery-csrf) feature enabled, `GET` requests that don't contain a `Content-Type` header must contain one of the following:
 
 - A non-empty `X-Apollo-Operation-Name` header
 - A non-empty `Apollo-Require-Preflight` header
 
-For more details, see [the CSRF prevention documentation](./security/cors#preventing-cross-site-request-forgery-csrf).
+For more details, see [the CSRF prevention documentation](../security/cors#preventing-cross-site-request-forgery-csrf).