Comment by BobVerg

CRIME attack isn't specific to request or response. If you pass secrets in response headers, then the attack can be performed against them.