Properly Understanding CORS with Same Host / Diffe

Question

I don't do much client side web programming, so I'm trying to grasp this concept in how it relates to my specific situation.

I have a RESTful WCF service running on a port in the 50000s. Additionally, I have a bunch of web forms (not ASP WebForms) written in HTML5/CSS3/JavaScript that make AJAX calls to this WCF service. The web forms are hosted on the same host, but are using port 80. The AJAX calls made by the web forms are all GET only requests.

Additionally, I have a third-party cloud-hosted application that's in a completely different location (different host), which needs to call the WCF service as well. This communication is performing POSTs & PUTs to the WCF service.

Obviously the calls being made from the third-party hosted cloud application is cross origin. From my research it appears that the different ports are in fact different origins.

I know that security & CORS are different concepts, but here is what I'm trying to accomplish and I need to better understand how all of this works:
Right now I allow all cross-origin requests, and everything is working, but I'd like to limit it down to improve security and then eventually set up HTTPS with transport security with both the webforms & WCF service using the same certificate. The third-party cloud service hosted-app would still need to be able to communicate with the WCF service so I would need to allow it to authenticate differently, so that would be done with a secret-key being passed since everything is server-side only.

This whole communication 'triangle' feels murky to me, and I hope that SO is the right place for me to be posting this question since it isn't directly code related.

1. Is the WCF - web forms situation described above considered cross-origin?
2. A) If the above is not cross-origin, would I then only need to pass the Access-Control-Allow-Origin: 'https://my-cloud-host' in my web.config?
   
   B) If it is I understand that just need to echo back the allowed origins(s) in the header. What do I set (if anything) for Access-Control-Allow-Origin in IIS in this case? What do I echo if it's not allowed, just the original origin?
3. Would my idea to use the same certificate for mutual SSL Authentication work if they are hosted on different ports? Would this prevent the cloud-service from communicating with the WCF service, or would having a second endpoint allow for this?
4. Am I losing my mind? I'm so confused by this whole thing.

Answer 1

1. Yes. In all major browsers except for IE, a different port IS considered to be another origin.
2. A) is correct. You need only to allow your port-80 origin to send requests.
3. I'm not sure about that. I tend to beleive that SSL is port-awared, and you can't use the same certificate on different ports.
4. You can read this excellent article to give your mind some rest.