As suggested by @zugazagoitia in #2104, we should consider rewriting the custom host scheme port logic in the CORS plugin to use the JDK's URI class.

I plan to look into this next weekend.

Yes, it is. An IPv6 or a domain name (any string of characters) are valid origins.

The Origin header contains a scheme, host and optionally a port. The host, defined by the URI spec is not limited to TLDs, localhost or any internal DNS names are also valid, as well as IP literals.