Disclaimer, I am new to InformationSecurity, so sorry if I not following rules as good as expected. I asked this post on stackOverflow, and I was suggested to transfer it here
So far I get:
- Origin = Schema (i.e. https) + host + port (may implicit)
- Authority = Userinfo (rarely use) + host + port
and while Domain Certificates applies for Fully-Qualified domains, WildCard Domains and Multiple Domains [i.e. list of sub-domains], but indeed only for https (so it gets schema implicitly)
on the other hand, the DNS resolution (some vendors) allow a domain IP forwarding, dedicated subdomain to different IP addresses, and a wildcard forwarding to another IP [ as sub-domains to identify services, aka protocols, still used sometimes :_( ]
two petitions to different schemas may share the same Authority but not Origins (avoiding CORS) and neither Certificates, what about other protocols as RTP, RTSP, SSH, FTP or SMTP ?? is that limiting protocol usage on secured web applications?
while not a common use practice, UserInfo may be user for some short of identification/segmentation, does it make it incompatible with SSL Certificates?
and lastly, on a scenario with several sub-domains identifying different machines (diferente IPs) does it gets to validate the same wildcard/multidomain certificate across machines??
read RFCs, plenty of info, and plenty of stackOverflow questions, still confused between those terms
lastly, and just to be sure, other than schema/authority/host/ports, nothing else have something to do with security within the URI, right? (I mean, any part of the path, or query, or so on)
"the purpose of this question is to clearly understand where all this concepts/terms collide, I believe I have good understanding of the OSI model and have read enough available documentation, but something still in gray area"