In a hidden DOM on the page. Updated asynchronously.
There is Javascript running on the page that updates the DOM.
So as long as the user is on the page, the "session" stays alive.
A session by definition extends beyond one page.
With some nastiness, you could make every link on the page a form submission and submit the session ID with the form. Then render it into the HTML that’s returned in response.