In the documentation (https://docs.rs/jsonwebtoken/5.0.1/jsonwebtoken/struct.Validation.html#structfield.validate_iat) it's mentioned that the validate_iat and validate_nbf fields are true by default, but in the source (https://docs.rs/jsonwebtoken/5.0.1/src/jsonwebtoken/validation.rs.html#98-99) the default value is false. This is also the behavior of the current release (5.0.1).