I found a solution to retrieve HttpSession from my managed bean.
PortalRequestContext portalContext = org.exoplatform.portal.webui.util.Util.getPortalRequestContext();
HttpSession httpSession = portalContext.getRequest().getSession(false);
Now, it works! May be it can help someone in the future.
I'm still interested by a documentation on how to create my own TokenService as a filter.
I had the same request, from a portlet to get a value set by the servlet filter.
Glad you posted the results.