# Buggy code
def setup_security(
    allowed_serializers=None,
    key=None,
    cert=None,
    store=None,
    digest="sha1",
    serializer="json",
    app=None,
):
    """See :meth:`@Celery.setup_security`."""
    if app is None:
        from celery import current_app

        app = current_app._get_current_object()

    _disable_insecure_serializers(allowed_serializers)

    conf = app.conf
    if conf.task_serializer != "auth":
        return

    try:
        from OpenSSL import crypto  # noqa
    except ImportError:
        raise ImproperlyConfigured(SSL_NOT_INSTALLED)

    key = key or conf.security_key
    cert = cert or conf.security_certificate
    store = store or conf.security_cert_store

    if not (key and cert and store):
        raise ImproperlyConfigured(SETTING_MISSING)

    with open(key) as kf:
        with open(cert) as cf:
            register_auth(kf.read(), cf.read(), store, digest, serializer)
    registry._set_default_serializer("auth")


# Traceback (kombu.exceptions.ContentDisallowed)
[2018-09-10 02:33:07,446: CRITICAL/MainProcess] Unrecoverable error: ContentDisallowed('Refusing to deserialize disabled content of type json (application/json)',)
Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/celery/worker/worker.py", line 205, in start
self.blueprint.start(self)
File "/usr/lib/python3.6/site-packages/celery/bootsteps.py", line 119, in start
step.start(parent)
File "/usr/lib/python3.6/site-packages/celery/bootsteps.py", line 369, in start
return self.obj.start()
File "/usr/lib/python3.6/site-packages/celery/worker/consumer/consumer.py", line 317, in start
blueprint.start(self)
File "/usr/lib/python3.6/site-packages/celery/bootsteps.py", line 119, in start
step.start(parent)
File "/usr/lib/python3.6/site-packages/celery/worker/consumer/consumer.py", line 593, in start
c.loop(*c.loop_args())
File "/usr/lib/python3.6/site-packages/celery/worker/loops.py", line 91, in asynloop
next(loop)
File "/usr/lib/python3.6/site-packages/kombu/asynchronous/hub.py", line 354, in create_loop
cb(*cbargs)
File "/usr/lib/python3.6/site-packages/kombu/transport/redis.py", line 1040, in on_readable
self.cycle.on_readable(fileno)
File "/usr/lib/python3.6/site-packages/kombu/transport/redis.py", line 337, in on_readable
chan.handlers[type]()
File "/usr/lib/python3.6/site-packages/kombu/transport/redis.py", line 667, in _receive
ret.append(self._receive_one(c))
File "/usr/lib/python3.6/site-packages/kombu/transport/redis.py", line 697, in _receive_one
message, self._fanout_to_queue[exchange])
File "/usr/lib/python3.6/site-packages/kombu/transport/virtual/base.py", line 983, in _deliver
callback(message)
File "/usr/lib/python3.6/site-packages/kombu/transport/virtual/base.py", line 633, in _callback
return callback(message)
File "/usr/lib/python3.6/site-packages/kombu/messaging.py", line 624, in _receive_callback
return on_m(message) if on_m else self.receive(decoded, message)
File "/usr/lib/python3.6/site-packages/celery/worker/consumer/gossip.py", line 201, in on_message
_, event = prepare(message.payload)
File "/usr/lib/python3.6/site-packages/kombu/message.py", line 207, in payload
return self._decoded_cache if self._decoded_cache else self.decode()
File "/usr/lib/python3.6/site-packages/kombu/message.py", line 192, in decode
self._decoded_cache = self._decode()
File "/usr/lib/python3.6/site-packages/kombu/message.py", line 197, in _decode
self.content_encoding, accept=self.accept)
File "/usr/lib/python3.6/site-packages/kombu/serialization.py", line 256, in loads
raise self._for_untrusted_content(content_type, 'disabled')
kombu.exceptions.ContentDisallowed: Refusing to deserialize disabled content of type json (application/json)

# Fixed code
def setup_security(
    allowed_serializers=None,
    key=None,
    cert=None,
    store=None,
    digest=None,
    serializer="json",
    app=None,
):
    """See :meth:`@Celery.setup_security`."""
    if app is None:
        from celery import current_app

        app = current_app._get_current_object()

    _disable_insecure_serializers(allowed_serializers)

    # check conf for sane security settings
    conf = app.conf
    if conf.task_serializer != "auth" or conf.accept_content != ["auth"]:
        raise ImproperlyConfigured(SETTING_MISSING)

    key = key or conf.security_key
    cert = cert or conf.security_certificate
    store = store or conf.security_cert_store
    digest = digest or conf.security_digest

    if not (key and cert and store):
        raise ImproperlyConfigured(SECURITY_SETTING_MISSING)

    with open(key, "r") as kf:
        with open(cert, "r") as cf:
            register_auth(kf.read(), cf.read(), store, digest, serializer)
    registry._set_default_serializer("auth")