Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which are then used to submit sensitive/confidential user information. The reason for using such mechanism is to exempt these user from requiring an account, as they are very unfrequent to the system. This URL authentication/identification system may resemble mechanisms used to validate or reset user accounts, with the difference that they are available for a longer time span (e.g. one or two weeks).
What are possible security flaws on using this mechanism to grant access to users? From my understanding, posting confidential information can be secured with SSL, however sharing these links through email is susceptible of someone intercepting the email being able to supplant the user while the link has not expired, which could result in unwanted submitted information to the server. I assume that one way to minimize risks is to enable people using the URL to POST content only, so nobody (not event the same, legitimate user) has access to any data previously submitted through the same link. So, I assuming that I am not missing anything else, is this authentication design choice justified or it is overall an unrecommended practice?
The alternative to this is to ask even unfrequent users to create a username/pwd. With this, you make sure that nobody makes undesired requests to your server, and in addition, you can choose to display personal information from the user anytime.