My hosting provider is offering an infrastructure-as-a-service (IaaS) product administered via a web interface, where the administrator can create and destroy virtual machines.
To access the web-based administration portal, I need to log in to the hosting provider's "service desk" (username & password over HTTPS), and then click on a generated link to access the IaaS administration portal (also HTTPS).
The link itself is most likely unguessable (it includes what looks like an md5 hash and 2 GUIDs), but anyone with access to that URL will have unrestricted access to the IaaS portal for several hours (the link seems to expire after that time).
I have tested that access via the link is not restricted to my specific IP address.
In short, anyone with the link could delete all of the VMs and my client's data, provided they get access to it within a couple of hours of it being generated.
Is this inadequate security for something like an IaaS portal (my gut feeling says no)? What specific concerns can I raise with the hosting provider?
Edit: I know that this question is similar to Is including a secret GUID in an URL Security Through Obscurity?, but that question relates to low-level HTTP clients, not browsers, which introduce additional concerns, like URL leaking, browser history, caching, etc.