What is the same-origin policy's definition of 'origin' and when are two URLs considered same-origin?

• A.Same origin means same domain name regardless of protocol or port; localStorage is partitioned per tab, and two tabs on the same origin cannot see each other's keys; blob: URLs are fetchable from any origin that learns the UUID, since blobs live outside the origin model; postMessage enforces origin checks automatically, discarding messages whose sender the receiver did not list
• B.Origins are compared only by domain name without subdomain consideration
• C.Origin is the combination of protocol (scheme), hostname, and port; two URLs are same-origin only if all three components match exactly - https://example.com:443 and http://example.com:80 are different origins despite the same domain
• D.Same origin means the same IP address regardless of hostname; the browser applies CSP only to same-origin scripts, with third-party scripts governed by their own site's policy; opening a data: URL inherits the opener's origin, cookies included, in every current browser