ServerUnauthorizedAccessException Getting the Term Store in Office 365 CSOM

Question

I have a Sharepoint provider hosted app and it get the term store in Office 365, It worked well for all users until a few days ago. Now fot the site collection administrators work fine but the others users dont, It throw the following exception:

Microsoft.SharePoint.Client.ServerUnauthorizedAccessException: Access denied. You don't have permission to perform this action or access this resource.

This is the code:

    [SharePointContextFilter]
    public ActionResult Index()
    {
        var spContext = SharePointContextProvider.Current.GetSharePointContext(HttpContext);
        using (var cc = spContext.CreateUserClientContextForSPHost())
        {
            TaxonomySession taxonomySession = TaxonomySession.GetTaxonomySession(cc);
            taxonomySession.UpdateCache();
            TermStore termStore = taxonomySession.GetDefaultSiteCollectionTermStore();
            cc.Load(termStore,
                termStoreArg => termStoreArg.WorkingLanguage,
                termStoreArg => termStoreArg.Id,
                termStoreArg => termStoreArg.Groups.Include(
                    groupArg => groupArg.Id,
                    groupArg => groupArg.Name
                    ));
            cc.ExecuteQuery();
        });
    }

AppManifest.xml

<?xml version="1.0" encoding="utf-8" ?>
<App xmlns="http://schemas.microsoft.com/sharepoint/2012/app/manifest"
      Name="xxxxxx"
      ProductID="{d5842f03-f7be-4125-83d1-c51cb375a42f}"
      Version="1.0.0.1"
      SharePointMinVersion="16.0.0.0"
>
  <Properties>
    <Title>xxxxxx</Title>
    <StartPage>~remoteAppUrl/?{StandardTokens}</StartPage>
    <UpgradedEventEndpoint>~remoteAppUrl/Services/AppEventReceiver.svc</UpgradedEventEndpoint>
    <InstalledEventEndpoint>~remoteAppUrl/Services/AppEventReceiver.svc</InstalledEventEndpoint>
    <UninstallingEventEndpoint>~remoteAppUrl/Services/AppEventReceiver.svc</UninstallingEventEndpoint>
  </Properties>

  <AppPrincipal>
    <RemoteWebApplication ClientId="*" />
  </AppPrincipal>
  <AppPermissionRequests>
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
    <AppPermissionRequest Scope="http://sharepoint/social/tenant" Right="FullControl" />
    <AppPermissionRequest Scope="http://sharepoint/taxonomy" Right="Write" />
  </AppPermissionRequests>
</App>

Answer 1

The code works fine. Can you confirm if the "AllowAppOnlyPolicy" is set to true in your AppManifest.xml? (AppPermissionRequests AllowAppOnlyPolicy="true").

When using "CreateAppOnlyClientContextForSPHost", AllowAppOnlyPolicy is the only thing that matters and if set to false, will cause the ServerUnauthorizedAccessException.

If it is already set to "true", there is a chance that either VS or SharePoint might be referring to a stale version of AppManifest.xml.