They're generally stored on the server. Where they're stored is up to you as the developer. You can use the session.save_handler
configuration variable and the session_set_save_handler
to control how sessions get saved on the server. The default save method is to save sessions to files. Where they get saved is controlled by the session.save_path
variable.