hard disk, main memory or somewhere else. I am not asking for the case where these are stored in database.
I suggest you to take a look into sessions chapter of rails security guide - it answers your question in detail and will help you to understand how it works.