Session fixation under Rails

Question

Because Rails stores the hash of every cookie to prevent tampering, is session fixation possible under the framework? How would an attacker change another user's session_id to match his own (which in turn alters the cookie) without destroying the integrity of this hash and invalidating the cookie? I'm fairly new to web security so forgive my question if its naive.

I'm assuming that XSS javascript can only alter the cookie client-side, maybe this is wrong.