Spring Boot RabbitMQ RabbitListener反序列化权限异常求助

按照Java Guides教程实现Spring Boot集成RabbitMQ，用@RabbitListener消费JSON格式消息时，控制台持续抛出ListenerExecutionFailedException，根因是SecurityException：com.example.springboot.dto.User类未被授权反序列化。已尝试在application.properties中设置spring.amqp.deserialization.trust.all=true，但问题仍未解决。

消费者代码 #

import com.example.springboot.dto.User;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.amqp.rabbit.annotation.RabbitListener;
import org.springframework.stereotype.Service;

@Service
public class RabbitMQJsonConsumer {
    private static final Logger LOGGER = LoggerFactory.getLogger(RabbitMQJsonConsumer.class);

    @RabbitListener(queues = {"${rabbitmq.queue.json.name}"})
    public void consumeJsonMessage(User user){
        LOGGER.info(String.format("Received JSON message -> %s", user.toString()));
    }
}

消息转换器配置代码 #

public MessageConverter converter(){
        return new Jackson2JsonMessageConverter();
    }

    @Bean
    public AmqpTemplate amqpTemplate(ConnectionFactory connectionFactory){
        RabbitTemplate rabbitTemplate = new RabbitTemplate(connectionFactory);
        rabbitTemplate.setMessageConverter(converter());
        return rabbitTemplate;
    }

异常信息 #

org.springframework.amqp.rabbit.support.ListenerExecutionFailedException: Failed to convert message
    at org.springframework.amqp.rabbit.listener.adapter.MessagingMessageListenerAdapter.onMessage(MessagingMessageListenerAdapter.java:158) ~[spring-rabbit-3.1.0.jar:3.1.0]
    at org.springframework.amqp.rabbit.listener.AbstractMessageListenerContainer.doInvokeListener(AbstractMessageListenerContainer.java:1662) ~[spring-rabbit-3.1.0.jar:3.1.0]
    at org.springframework.amqp.rabbit.listener.AbstractMessageListenerContainer.actualInvokeListener(AbstractMessageListenerContainer.java:1581) ~[spring-rabbit-3.1.0.jar:3.1.0]
    at org.springframework.amqp.rabbit.listener.AbstractMessageListenerContainer.invokeListener(AbstractMessageListenerContainer.java:1569) ~[spring-rabbit-3.1.0.jar:3.1.0]
    at org.springframework.amqp.rabbit.listener.AbstractMessageListenerContainer.doExecuteListener(AbstractMessageListenerContainer.java:1560) ~[spring-rabbit-3.1.0.jar:3.1.0]
    at org.springframework.amqp.rabbit.listener.AbstractMessageListenerContainer.executeListenerAndHandleException(AbstractMessageListenerContainer.java:1505) ~[spring-rabbit-3.1.0.jar:3.1.0]
...
Caused by: java.lang.SecurityException: Attempt to deserialize unauthorized class com.example.springboot.dto.User; add allowed class name patterns to the message converter or, if you trust the message orginiator, set environment variable 'SPRING_AMQP_DESERIALIZATION_TRUST_ALL' or system property 'spring.amqp.deserialization.trust.all' to true
    at org.springframework.amqp.utils.SerializationUtils.checkAllowedList(SerializationUtils.java:165) ~[spring-amqp-3.1.0.jar:3.1.0]
    at org.springframework.amqp.support.converter.AllowedListDeserializingMessageConverter.checkAllowedList(AllowedListDeserializingMessageConverter.java:61) ~[spring-amqp-3.1.0.jar:3.1.0]
    at org.springframework.amqp.support.converter.SimpleMessageConverter$1.resolveClass(SimpleMessageConverter.java:151) ~[spring-amqp-3.1.0.jar:3.1.0]
    at java.base/java.io.Ob

问题根源 #

异常栈显示当前使用的是SimpleMessageConverter而非你配置的Jackson2JsonMessageConverter，说明消费者端没有正确应用自定义的消息转换器，导致默认的SimpleMessageConverter触发了反序列化权限校验。

解决方法 #

方法1：为消费者容器工厂配置消息转换器 #

创建RabbitListenerContainerFactory Bean，指定使用自定义的Jackson2JsonMessageConverter：

@Bean
public RabbitListenerContainerFactory<?> rabbitListenerContainerFactory(ConnectionFactory connectionFactory) {
    SimpleRabbitListenerContainerFactory factory = new SimpleRabbitListenerContainerFactory();
    factory.setConnectionFactory(connectionFactory);
    factory.setMessageConverter(converter()); // 绑定自定义消息转换器
    return factory;
}

如果存在多个容器工厂，可在@RabbitListener注解中指定：

@RabbitListener(queues = {"${rabbitmq.queue.json.name}"}, containerFactory = "rabbitListenerContainerFactory")

方法2：给Jackson2JsonMessageConverter添加信任类/包 #

如果不想全局信任所有类，可直接给消息转换器配置允许反序列化的范围：

public MessageConverter converter(){
    Jackson2JsonMessageConverter converter = new Jackson2JsonMessageConverter();
    // 信任指定包下的所有类
    converter.addTrustedPackages("com.example.springboot.dto");
    // 或者信任单个类
    // converter.addTrustedClass(User.class);
    return converter;
}

方法3：确保全局信任配置生效 #

如果坚持使用spring.amqp.deserialization.trust.all=true，需确认配置加载情况：

• 检查application.properties是否在src/main/resources目录下
• 启动时添加JVM参数：-Dspring.amqp.deserialization.trust.all=true
• 或在代码中强制设置系统属性：

static {
    System.setProperty("spring.amqp.deserialization.trust.all", "true");
}

内容的提问来源于stack exchange，提问作者omnicoder9