Where is the session key stored on the client side after SSL handshake?
<p>I am new to the ideas of secure connections through cookies/sessions so I am doing some research and I came across the SSL handshake. I understand that:</p>

<ol>
<li>browser sends an initial request to a server</li>
<li>Server sends certificate (containing a public key n) to browser</li>
<li>Browser chooses a random x (I don't know how this is done), and computes (x^65537 mod n), and sends this computed value back to the Server</li>
<li>Server decrypts this computed value using their two private (usually prime) keys</li>
<li>Server and client now have a "session key" which only the two parties know about. They now use this session key to encrypt all messages belonging to this session.</li>
</ol>

<p>I found a question <a href="https://stackoverflow.com/questions/28830383/where-does-ssl-symmetric-key-is-stored">Here</a> talking about where this SSL symmetric key (session key) is stored on the Server side.</p>

<p>On the client side however, I've tried opening the developers console and looking for it but I can't find it. This makes sense, obviously I shouldn't be able to easily find it. Where is this session key stored on the <b>client side</b>? Is it possible for my session key to be stolen during an XSS attack?</p>