I've come across websites using both a HTTP-header based canonical as well as a tag-based canonical. Sometimes they are not referencing the same URL which brings me to my question - does one have priority over the other and is there a SEO related penalty to using both on same the same page?
Since Googlers mention this issue on one of their blog post:
Specify no more than one rel=canonical for a page. When more than one is specified, all rel=canonicals will be ignored.
Google algorithm can can ignore both of them if they point to different urls
If they do not link to the same there will be trouble for the good old g-bot. He does not know what to do then with those pages. The outcome will be less or wrong indexed pages. Which will lead to loss of rankings.
Normally such stuff will be shown in the search console messages if something like this is happening.
Same with hreflang - different/wrong setup = google bot gets confused and does "stupid stuff".