Where is the wordpress session stored?

How WordPress stores cookies (client-side, as @birgire stated):
https://codex.wordpress.org/WordPress_Cookies

I doubt this will ever work from a separate subdomain as the cookie domain is usually fully-qualified to the WordPress siteurl (someone feel free to correct me.)

If you were doing it with another app on the same domain, you’d need to make use of the wp_validate_auth_cookie() function (in wp-includes/pluggable.php) – that looks at $_COOKIES, generates a hash from the user’s database record and checks if it matches the cookie. If it does, you get their user ID back.