title: How to disallow pickle serialization in celery
body: <p>Celery defaults to using pickle as its serialization method for tasks.  As noted in the <a href="http://ask.github.com/celery/faq.html#isn-t-using-pickle-a-security-concern" rel="noreferrer">FAQ</a>, this represents a security hole.  Celery allows you to configure how tasks get serialized using the <code>CELERY_TASK_SERIALIZER</code> configuration parameter.  </p>
  
  <p>But this doesn't solve the security problem.  Even if tasks are serialized with JSON or similar, the workers will still execute tasks inserted into the queue with pickle serialization -- they just respond to the <code>content-type</code> parameter in the message.  So anybody who can write to the task queue can effectively pown the worker processes by writing malicious pickled objects.</p>
  
  <p>How can I prevent the worker threads from running tasks serialized with pickle?</p>