What happens when the url matches multiple access rules?

[spietras]

Let's say:

- id: allow-rule
  match:
    url: "<.*>"
  authorizer:
    handler: allow
- id: deny-rule
  match:
    url: "<.*>"
  authorizer:
    handler: deny

Will it be detected at startup and some error reported? Or the first match will be used (thus allowing all requests in this case)?

Couldn't find an answer in the documentation.

[gen1us2k]

Unfortunately oathkeeper does not handle it at startup but you'll get an internal server error because of duplicated URL patterns with the following message

  "error": {
    "code": 500,
    "status": "Internal Server Error",
    "message": "Expected exactly one rule but found multiple rules"
  }
}