Where are the sessions stored?

If the session_handler option has the session.handler.native_file vakue, then the sessions are stored in the app/cache/sessions folder.

If you want to store the sessions in the OroCRM database, then use session.handler.pdo value.
The third possible value is snc_redis.session.handler (for storing the sessions in Redis).