Correction: I meant to say: Are session variables stored server-side or
client-side like cookies?
The session data is stored on the server. The session cookie (if there is one) is stored in the browser.
How do I go about making a session last longer that the duration of the
browser?
Set the expiration on the session cookie so that it's a month from now, using the set_session_cookie_params() function. Also, force the users to accept cookies (somehow). Then change the garbage collection so that it won't trash session data for at least a month.
Considering how inefficient all of that is, you might be better off storing the data in a database instead of a session and then storing the database record ID in a cookie in the browser. There are some serious security considerations here but it will get your results and won't rely upon PHP's sessions. Again, this isn't ideal but it's a start...
Hope that helps,
Larry