The CRIME attack is about making the target client to send phony GET requests to the server, such that each request:
- contains the path chosen by the attacker,
- and also contains some secret value that the attacker is interested in.
<img> tags. Each such tag makes the client do a GET to the server.
If the client is configured to automatically send the user password, as part of Basic Authentication, in the relevant header for each request, then it can be attacked just like a cookie. CRIME applies.
An important point, though, is that CRIME is a Chosen-Plaintext Attack: it works in contexts where the attacker can make the victim issue requests containing both the secret value, and some data that the attacker can choose. This certainly applies to a Web browser, but not necessarily to other contexts such as a custom XML-RPC client. It really depends on what the requests contain.
In general, compression of any kind inherently increases information leaks, because encryption does not hide data size, and compression makes data size dependent on data contents. The specific case of CRIME is when the compression is applied at the SSL level, because it then encompasses an area (the HTTP headers) full of values which are, from the point of view of the attacker, very juicy. However, if there is a secret value that the attacker wants to obtain, such that the value is located in the request bodies, then HTTP-level compression could be equally vulnerable.
If you want the benefits of compression, then you will also get the disadvantages of compression, namely this increase in leaks. This requires some thorough, specific analysis.
(Note that size-related leakages are not specific to compression; text-based representations, e.g. a decimal integer in XML, can also have a variable size which depends on the exact data contents; however, compression exacerbates the issue, making it much easier to turn the leak into a successful attack.)