I know of at least one carrier, but is only usable for their own customer self care portals/apps. There it is possible to auto-login to their app if it is accessed via their network and not via Wi-Fi. For security reasons only a limited amount of functionality is accessible. Neither customer data can be changed nor can any actions resulting in additional cost (buying packs / options) be performed without additional authentication mechanism of a higher security level (auto-login via SMS or use of a password).
The MSISDN is only added to the HTTP request internally in their secure network and never exposed externally.
Like, have http://my.number/ return the phone number for identification (though it would need some permission, I don't want every app to have access to it).
Make a HTTP POST with some data to http://my.number/validate and have it signed by the carrier, validate it against a list of public keys per carrier. Not sure why that wouldn't work today? It could even be a private/reserved IP address routed by all carriers to their auth service.
Edit: obviously, it wouldn't work over Wi-Fi without some cooperation at the OS level.
Those little security-by-securing-all-handset mechanisms kind of worked while there weren’t any publicly known rooted phone, in the wild, that can establish a session on featurephone APN, but emergence of iPhone and Android extinguished it.