Handling CSP Errors - node.js

Question

I am writing a client program to connect to a website over HTTP/HTTPS. The program first tries to connect to the server using HTTPS. However, after receiving a response status code of 301, I tried handling the request with HTTP whenever there is a 301 by making a new request to the HTTP server. As is commonly done to consume data, I added a listener callback on the 'data' event of the http.get() using the on method of http.clientRequest. However, there is no data in the console output. I am suspecting this is due to the following CSP header that I have been receiving with requests:
Message Headers:
content-type: text/html; charset=UTF-8
location: http://www.whoscored.com/
server: Microsoft-IIS/8.0
strict-transport-security: max-age=16070400
content-security-policy: frame-ancestors *.whoscored.com; upgrade-insecure-requests;
x-content-security-policy: frame-ancestors *.whoscored.com; upgrade-insecure-requests;
date: Sun, 29 Oct 2017 02:44:33 GMT
connection: close
content-length: 148
Logging the data:
The code is provided below:
Https.get(options, (res: Http.IncomingMessage): void => {
logger.log('HTTPS Client for ScrapeX');
logger.log('-------------------------');
logger.logHeaders(res.headers);
switch(res.statusCode) {
case 200:
(() => {
//
logger.log('The connection was established successfully');
})();
break;
case 301:
(() => {
// fallback to http
let buf = '';
httpClient((res1) => {
logger.log('HTTP Client');
logger.log('----------------');
logger.logHeaders(res1.headers);
}, n_options)
.on('error', (err) => {
logger.log('Error: ' + err.message);
logger.printStack(err);
})
.on('data', (chunk: string): void => {
buf += chunk;
})
.on('close', () => {
logger.log('Logging the data: ');
logger.log(buf);
});
})();
break;
}
})
.on('error', (err) => {
logger.log(err.message);
logger.log(err.stack);
})
.on('close', () => {
logger.log('Connection closed');
});

Answer 1

You can't connect to that server with HTTP, that's your problem; it's using both upgrade-insecure-requests and more importantly strict-transport-security. Any browser that respects strict-transport-security will simply refuse to connect over unsecured HTTP.
Not sure what to tell you beyond in this case you simply can't retry in HTTP, or at least, it'll always give either an error or just redirect to HTTPS.
The CSP shouldn't really be an issue, that's for loading other resources while on that page, it doesn't block people from downloading the page in the first place.