What is the same-origin policy's definition of 'origin' and when are two URLs considered same-origin?

• A.Origin is the combination of scheme (protocol), hostname, and path; two URLs are same-origin only if all three components match - https://example.com/a and https://example.com/b are different origins
• B.Origin is the combination of hostname (domain), port, and IP address; two URLs are same-origin only if all three resolve alike - https://a.example.com and https://b.example.com share one origin
• C.Origin is the combination of protocol (scheme), hostname, and port; two URLs are same-origin only if all three components match exactly - https://example.com:443 and http://example.com:80 are different origins despite the same domain
• D.An origin consists of scheme (protocol), registrable domain, and port; two URLs are same-origin only if all three match - https://www.example.com and https://api.example.com are the same origin