Add API Security learning center foundation #109

themattwilliams · 2025-09-30T20:03:58Z

Overview

This PR establishes the foundation for the API Security learning center with the landing page, sidebar structure, and stub articles for all security topics.

What's Included

Landing page (learn/security/index.md) - "API Security by Design: Framework and Fundamentals"
Sidebar configuration (learn/security/sidebars.yaml) - Navigation structure for all security articles
Stub articles - Placeholder content for upcoming security articles:
- TLS Encryption and HTTPS Best Practices
- Input Validation and Injection Prevention
- Rate Limiting and Abuse Prevention
- Authentication and Authorization with OpenAPI
Reference files (_filesets/) - Security validation configuration files for future review

Why Foundation First?

This PR must merge before individual article PRs to ensure:

Sidebar structure exists for all articles
Navigation links resolve correctly
No broken links or "Can't resolve page" errors

Dependencies

Blocks: Individual article PRs (mw-security-tls-encryption, mw-security-input-validation, mw-security-rate-limiting, mw-security-authentication)
Required merge order: This PR → Individual articles

Review Checklist

Landing page renders correctly at /learn/security
Sidebar shows all article links (even if stub content)
No broken links or navigation errors
External links open in new tabs
Internal links use correct paths (/learn/security/...)

Preview

Once deployed, preview at: https://redocly.com/learn/security

- Created new Security learning center card in cards.ts - Added learn/security/ directory with proper structure - Added comprehensive API design-first security guide article covering TLS, input validation, rate limiting, and access control - Fixed TOC navigation by removing bold formatting from headings - Removed confusing Mermaid diagrams per feedback - Added proper anchor links for deep navigation - Updated sidebars.yaml and created security index page

This article belongs on a separate branch for API testing, not the security branch.

…ization - Split original api-design-first-security-guide.md into 6 focused articles - Remove Redocly branding to create vendor-neutral security content - Add 3 strategic Mermaid diagrams (#4, #5, #7) for visual learning New Articles Created: • learn/security/index.md - Main landing page with article overview • api-tls-encryption-https-best-practices.md - TLS 1.3, HTTPS, mTLS guide • api-input-validation-injection-prevention.md - Schema validation, SQL injection prevention • api-rate-limiting-abuse-prevention.md - DoS protection, rate limiting algorithms • authentication-authorization-openapi.md - JWT, OAuth2, security schemes • api-design-first-security-governance.md - Automated governance, policy-as-code Navigation & UX Improvements: • Updated learn/security/sidebars.yaml with organized article structure • Enhanced pages/learning-center/cards.ts with all 6 security articles • Added strategic cross-links between related security topics • Implemented target='_blank' links to preserve user navigation context • Fixed URLs to use clean paths without .md extensions Content Quality: • Each article SEO-optimized with focused keywords and standalone value • Comprehensive cross-referencing between security domains • Real-world case studies: Heartbleed, Equifax, Facebook phone scraping • Practical code examples and governance rule implementations • Progressive learning path from infrastructure to organizational maturity

- Add originals/redocly.yaml: Clean production version without chunk annotations - Add originals/security-functions.ts: TypeScript implementation of custom security validation functions - Includes 4 advanced security validation functions: checkOperationSecurity, validateAdminSecurity, validateOAuthScopes, validateRateLimitConsistency

- Remove original files from _filesets (moved to originals/ folder) - Update automated-security-validation-walkthrough.md - Add new walkthrough versions: automated-security-validation-walkthrough-v2.md and test-simple-walkthrough.md - Update learning center cards and root redocly.yaml configuration

- Convert SQL injection examples from Python to JavaScript with Express.js - Convert rate limiting algorithms from Python/Go to JavaScript (Token Bucket, Sliding Window, Fixed Window) - Convert authorization monitoring from Python to JavaScript with Express middleware - Convert validation metrics from Python to JavaScript with Map/Set data structures - Convert rate limit testing framework from Python asyncio/aiohttp to JavaScript fetch/Promise.all - Update all tab labels and code block titles to reflect JavaScript - Maintain all security highlighting and educational explanations - Provide consistent Node.js developer experience across all security articles

- Changed 'pages:' to 'items:' in sidebars.yaml to match Redocly syntax - All security articles now display correctly in left navigation menu - Fixed sidebar configuration for API Security Fundamentals group

- Delete api-design-first-security-guide.md (replaced by focused individual articles) - Remove from sidebars.yaml navigation - Update main landing page title to 'Framework and Fundamentals' instead of 'Complete Guide' - Cleaner navigation with 5 focused security articles + landing page + walkthrough

- Delete automated-security-validation-walkthrough.md (temporarily removed) - Update sidebars.yaml to remove walkthrough from navigation - Final security learning center now has 5 focused articles + landing page

- Landing page with updated 'Framework and Fundamentals' title - Complete sidebar navigation structure - Placeholder stub articles with proper frontmatter and outlines - No broken links - all navigation functional - Ready for individual article content PRs Stubs created for: - TLS Encryption and HTTPS Best Practices - Input Validation and Injection Prevention - Rate Limiting and Abuse Prevention - Authentication and Authorization with OpenAPI

- Add redocly.yaml: Production-ready security validation configuration (505 lines) - Add security-functions.ts: TypeScript custom security validation functions (239 lines) - Files placed in _filesets directory for review purposes only (not linked in navigation) - Includes 4 advanced validation functions: checkOperationSecurity, validateAdminSecurity, validateOAuthScopes, validateRateLimitConsistency

learn/security/index.md

learn/security/_filesets/redocly.yaml

learn/security/_filesets/security-functions.ts

learn/security/index.md

This is a reference file for review purposes only and should not attempt to load plugins during build.

@adamaltman