Where exactly are session variables saved? Cookies? Server memory?
Again where are Application variables saved?
Session variables are stored on Server Memory and Disk as Application Variables are.
From ASP.NET documentation:
ASP.NET session state supports several storage options for session variables. Each option is identified as a session-state Mode type. The default behavior is to store session variables in the memory space of the ASP.NET worker process. However, you can also specify that session state should be stored in a separate process, in a SQL Server database, or in a custom data source. If you do not want session state enabled for your application, you can set the session mode to Off.