In modern W3C and WhatWG specs, an "origin" is either a (scheme, host, port) triple or a nonce value. The asterisks in this case are being used as a shorthand for "any origin which is a triple and whose host is localhost, no matter what the scheme and port are".
