fix new doc (#1093)

docs/03.Advanced-Cookbook/3.02.Flash-Sale.md

@@ -267,7 +267,7 @@ From the view of business, after we permit a lucky user to go forward, we should
 
 Fortunately, all users need to sign in before joining the flash sale, that's the requests will contain an identifier of the user, we can use this identifier to record the lucky users.
 
-As an example, we suppose the value of the `Authorization` header is the desired identifier (the identifier could be a JWT token, and the [Validator filter](./security.md#security-verify-credential) can be used to validate the token, but this is out of the scope of this document).
+As an example, we suppose the value of the `Authorization` header is the desired identifier (the identifier could be a JWT token, and the [Validator filter](../02.Tutorials/2.5.HTTPS-Lets-Encrypt.md#security-verify-credential) can be used to validate the token, but this is out of the scope of this document).
 
 However, due to the `maxConcurrency` option in the filter configuration, using a `Set` the store all permitted users won't work.