Could it be that your host uses varnish, or some other caching system? If so, you could try either disabling varnish (or whatever), or trying database-based session management.

Thanks for your response. I don't recall that they use varnish, but I will do some research with my host, as I have other issues that feel like they may be cache related.

Can you expand on the database-based session management? (Not a developer, sorry...) I am still getting token errors every time I try to upload a file. The web host setup doesn't have varnish or memcached or any other server-based caching software installed. Thanks again for your response.

It would be good if someone who knew what they were talking about chimed in!

If this isn't a caching problem, alternative session management probably won't help. However, given no other ideas, it might be worth a try. Instructions for developers are here:
https://documentation.concrete5.org/tutorials/enable-database-based-...

Make sure you keep a copy of the original file in case Bad Things happen.

Thank you for the link. I will make a backup of the original and try modifying that file. If it's not that, I wonder (and am going to display my ignorance here) if there is something not right in the .htaccess file? Or could a theme or addon cause these issues? I love concrete5, but this is baffling to me. Maybe I will set up a vanilla site with Elemental and no addons to see if I have the same issues.

Sorry. I am replying to you, because I didn't want to reply to myself... So, the linked developer note says:

"To enable database based sessions in concrete5.7+ you simply need to add a configuration value to /application/config/concrete.php"

All well and good, but there is no concrete.php in the /application/config/ folder. Would it be this one? /application/config/generated_overrides/concrete.php.

(The one that says "Do not edit this file directly....)

No, not that one..
You need to create your own blank concrete.php file and add your custom code..

I see that Genesis was written for 5.7, it could be a compatibility issue.
Try changing to the default elemental theme and see if the problems go away..

I will do that, and I will also check with the theme developer. The "update" to version 8 has been a bit funky, because a lot of themes/addons are compatible with V5.7+ or V5.74+ or whatever, which implies compatibility with V8. But then developers have been adding their own Version 8 Compatible "stickers" to their listings in the marketplace. As a non-developer, I wish there were the same approval process and a standard means of knowing what is actually "V8-ready." (The Genesis theme said it was.)

And now, I am babbling. Thanks again for your help!

Thanks! And then just save it in the /application/config/ folder?

Yes. When c5 runs, it should read that file and update its stuff in generated_overrides if it needs to.

Thanks again. But does the file need any other code? I tried it with just that code, and all I get is the error messages below: My apologies for not knowing this kind of stuff. (I've asterisked out the path here.)

return array( 'session' => array( 'handler' => 'database' ) );
Warning: array_replace_recursive(): Argument #2 is not an array in /home/*****/public_html/concrete/vendor/illuminate/config/Illuminate/Config/FileLoader.php on line 102
return array( 'session' => array( 'handler' => 'database' ) );
Warning: array_replace_recursive(): Argument #2 is not an array in /home/*****/public_html/concrete/vendor/illuminate/config/Illuminate/Config/FileLoader.php on line 102
The cache directory must be published under the webroot (or you can set the concrete.cache.directory_relative configuration option)

Try putting this line at the very start of the file:

That didn't do it, but I talked with the web host. The sites were on an older server (VPS), which didn't seem to affect 5.6 or 5.7 sites. They migrated the sites to newer servers, and so far, image uploading has been successful. So it may have just been the server environment.

Thanks for everyone's help.

For anyone else who has this problem. We've just had this issue and it looks like it was a cache problem in our case. It turns out we were making use of browser caching in the htaccess file something like this:

This seems to cause weird problems in the backend of C5 such as caching attribute and error values etc. removing this seems to have resolved the invalid token error for us