diff --git a/otterwiki/auth.py b/otterwiki/auth.py
index 42667e93..52e2bc12 100644
--- a/otterwiki/auth.py
+++ b/otterwiki/auth.py
@@ -646,7 +646,11 @@ def __init__(
 
     @staticmethod
     def _parse_roles(roles_str):
-        return {r.strip().upper() for r in roles_str.split(',') if r.strip()}
+        return {
+            r.strip().upper()
+            for r in re.split(r'[,\s]+', roles_str)
+            if r.strip()
+        }
 
     def _map_roles_to_permissions(self, header_roles):
         header_roles = set(header_roles)
diff --git a/tests/test_auth_proxy_header.py b/tests/test_auth_proxy_header.py
index e846f974..fd81547c 100644
--- a/tests/test_auth_proxy_header.py
+++ b/tests/test_auth_proxy_header.py
@@ -284,6 +284,9 @@ def test_parse_roles(create_app):
         ProxyHeaderAuth._parse_roles  # pyright: ignore[reportPrivateUsage]
     )
     assert parse_roles("moderator, admin") == {"MODERATOR", "ADMIN"}
+    assert parse_roles("moderator ,admin") == {"MODERATOR", "ADMIN"}
+    assert parse_roles("moderator admin") == {"MODERATOR", "ADMIN"}
+    assert parse_roles("moderator  admin") == {"MODERATOR", "ADMIN"}
     assert parse_roles(" admin ") == {"ADMIN"}
     assert parse_roles("a,,b, ,c") == {"A", "B", "C"}
     assert parse_roles("") == set()