Where are the session variables saved?

Variables put into Session are stored wherever the configured SessionStateProvider is configured to store them.

The default SessionStateProvideruses what's referred to as In Process (InProc) Session and the storage location for this is in server memory, inside the memory space of the ASP.NET worker process.

You can configure your own SessionStateProvider to store Session variables elsewhere, such as out of process, in a database.

Application variables are stored in ApplicationState which is also stored in the memory space of the ASP.NET worker process. Unlike Session State, Application State applies to all users and sessions. As far as I am aware, There is no configuration to store ApplicationState elsewhere; if you need to store lots of application data then you may want to look at ASP.NET Caching.

Session variables are stored on Server Memory and Disk as Application Variables are.

From ASP.NET documentation:

ASP.NET session state supports several storage options for session variables. Each option is identified as a session-state Mode type. The default behavior is to store session variables in the memory space of the ASP.NET worker process. However, you can also specify that session state should be stored in a separate process, in a SQL Server database, or in a custom data source. If you do not want session state enabled for your application, you can set the session mode to Off.

For an InProc session, variables are stored locally in memory of ASP.NET worker process. Same goes for application state.