chore: document rate-limits

[tricky42]

Related Issue or Design Document

Checklist

• I have read the contributing guidelines and signed the CLA.
• I have referenced an issue containing the design document if my change introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security vulnerability.
  If this pull request addresses a security vulnerability,
  I confirm that I got approval (please contact [email protected]) from the maintainers to push the changes.
• I have added tests that prove my fix is effective or that my feature works.
• I have added the necessary documentation within the code base (if appropriate).

Further comments

[tkjwa]

Do the rate limit on whoami also apply when using Edge sessions ?

[tricky42]

https://docs-37gnua6hd-ory.vercel.app/docs/guides/rate-limits

[vinckr]

looks good.
should we also link it here https://www.ory.sh/docs/ecosystem/security and on h1 for our hackers?

also should we add a disclaimer that these rates are subject to change, the documentation might not always reflect the latest state and is more to give you a ballpark idea?

[tricky42]

Do the rate limit on whoami also apply when using Edge sessions?

Yes, the rate limit on whoami applies when using edge sessions, as we trigger a revalidation with each request. In the future, we will further improve the logic here. The limits for whoami, therefore, are significantly higher than the other limits.