How is a replay attack specifically mitigated at the server-side validation service for an HMAC-Based One-Time Password (HOTP) token?

A replay attack, in the context of an HMAC-Based One-Time Password (HOTP) token, occurs when an attacker intercepts a valid one-time password (OTP) and attempts to resubmit it at a later time to gain unauthorized access. HOTP is a counter-based algorithm, meaning that the one-time password generated by the token is derived from a shared secret key and a unique, incrementing counter value. Both the HOTP token and the server-side validation service maintain their own synchronized counter values for each user. Server-side mitigation for replay attacks hinges on the server's meticulous management of this counter. When a user submits an OTP, the server performs the following validation: it calculates its own expected OTPs using ....