I'm trying to come up with a list of built-in mechanisms that either automatically send authentication information or automatically prompt the user to provide them in browsers.
So far I have
Cookies - sends cookies based on domain / expiration etc
401 WWW-Authenticate: Negotiate (SPNEGO/GSS-API) - for whitelisted domains (needs browsers configuration) usually for Kerberos / NTLM
FIDO U2F (in supported browsers) - requires users to perform an action when prompted for a challenge
WebAuthn (still in development, similar to the above)
And obviously also Basic authentication (401 WWW-Authenticate: Basic)
Are there any other mechanisms to add to the above? (I'm excluding SAML/OIDC/OAuth as they don't have any native support or special treatment as far as I know)