title: Sec-Fetch-Mode and blocked CORS
body: <p>So I have the same website making the same request to the same server on (1) Chrome 76 and (2) Chrome 77 from different networks and computers.</p>
  
  <p>One request has (1) <code>Sec-Fetch-Mode: no-cors, Sec-Fetch-Site: cross-site</code> and the other one (2) <code>Sec-Fetch-Mode: cors, Sec-Fetch-Site: same-site</code>.
  The one with <code>no-cors</code> fails with a 400 to a C# Web API endpoint with CORS enabled (for years and thousands of different users on all kinds of devices).</p>
  
  <p>What is going on? There is talk of a Chrome <a href="https://github.com/w3c/webappsec-fetch-metadata/issues/35" rel="noreferrer">bug</a> not sending that header for pre-flight, but there it is and set to <code>no-cors</code>.</p>
  
  <p>Security setting or bug in Chrome? Fixable server-side or front-end-side?</p>
  
  <p><strong>This is sent by an XMLHttpRequest, not the new Fetch-API.</strong></p>