above.Here is the code:public class FacebookAuthorizationFilter implements Filter { public static final String AUTH_URL_BASE = "https://www.facebook.com/dialog/oauth?client_id=%s&redirect_uri=%s&scope=%s"; public static final String ACCESS_TOKEN_URL_BASE = "https://graph.facebook.com/oauth/access_token?client_id=%s&redirect_uri=%s&client_secret=%s&code=%s"; @Override public void init(FilterConfig filterConfig) throws ServletException { /*init code*/ } @Override public void destroy() { /*destroy code*/ } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest req = (HttpServletRequest) request; HttpServletResponse resp = (HttpServletResponse) response; String code = request.getParameter(MyConstants.CODE_PARAM_KEY); String accessToken = request.getParameter(MyConstants.ACCESS_TOKEN_PARAM_KEY); if(accessToken != null) { //there is one already let the application follow usually chain.doFilter(req, resp); return; }else { if(code == null) { //ask for authorization from facebook resp.sendRedirect(String.format(AUTH_URL_BASE, this.appKey, this.redirectURI, this.scope)); } else { //already authorized, fetch the access_code accessToken = retriveAccessToken(code); //save the access_token req.getSession().setAttribute(MyConstants.ACCESS_TOKEN_KEY, accessToken); chain.doFilter(req, resp); } } } /** * Retrieves the content of the page with the access_code token * @param code the code parameter passed to the redirect_uri from the oath/dialog page * @return The String access_token provided from facebook * @throws IOException */ private String retriveAccessToken(String code) throws IOException { URL url = new URL(String.format(ACCESS_TOKEN_URL_BASE, this.appKey, this.redirectURI, this.appSecret, code)); //TODO: Try to sintetize with CharStreams from guava-libraries ByteArrayOutputStream byteWriter = new ByteArrayOutputStream(); InputStream urlReader = url.openStream(); int r; while((r = urlReader.read()) != -1) { byteWriter.write(r); } String fetchedResult = new String(byteWriter.toByteArray()); String[] fields = fetchedResult.split("&"); //TODO: Make a regex to extract that for(String field : fields) { String[] pair = field.split("="); if(pair.length == 2 && pair[0].equals("access_token")) { return pair[1]; } } throw new RuntimeException(fetchedResult); }}Sumaring the process on a servlet:Make a filter that asks for the client object or access_token on the session objectcIf there is no parameter in the session stops the request and redirect to:https://www.facebook.com/dialog/oauth?client_id=YOUR_APP_ID&redirect_uri=YOUR_URL&scope=email,read_streamWhere scope are the permissions you wantThe redirect_uri is going to work this case and you must to have a filter in the redirect_uri able to get the code parameter (line 30 in the snippet above)Fetch the content of the follow URL:https://graph.facebook.com/oauth/access_token?client_id=YOUR_APP_ID&redirect_uri=YOUR_URL&client_secret=YOUR_APP_SECRET&code=THE_CODE_FROM_ABOVE(Lines 48 to 56 in the snippet above)Parse the content to extract the parameters (at least acess_token) (lines 60 to 65 on the snippet above)With access_token you can create the actual client object to access facebook data (line 37 on the snippet above)Put the object where you can retrieve it (line 35 in the snippet above)