What is the 'Same-Origin Policy' and what three attributes define 'same origin'?

• A.The Same-Origin Policy requires same IP address, same server software, and same TLS certificate
• B.The Same-Origin Policy restricts how documents and scripts from one origin can interact with resources from another. Two URLs are same-origin if they share identical: scheme (http/https), host (exact hostname including subdomains), and port (explicit or default). https://app.example.com:443 and https://api.example.com:443 are cross-origin (different host)
• C.Same-origin requires matching scheme and host; port differences are ignored for security checks
• D.Same-origin applies only to XHR and fetch requests; script tags are exempt from the policy