Configuration.SectionInformation.ProtectSection generates two connection strings for one

Question

I am trying to encrypt the connection string section in the config file. There is only one connection string in the original config file, that is a oracle connection string. But after encryption, there are two connection strings.
The original config file is like
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
 <connectionStrings>
  <add name="Ref_ConnectionString"
   connectionString="Data Source=aaa;User ID=bbb;password=ccc"
   providerName="System.Data.OracleClient" />
 </connectionStrings>
 <appSettings>
  <add key="sp_AddRefName" value="sp_AddRef"/>
 </appSettings>
</configuration>
The coding to encrypt is like:
System.Configuration.Configuration config =
ConfigurationManager.OpenExeConfiguration(configFile);
ConfigurationSection section = (ConfigurationSection)config.GetSection("connectionStrings");
section.SectionInformation.ProtectSection("RsaProtectedConfigurationProvider");
section.SectionInformation.ForceSave = true;
config.Save(ConfigurationSaveMode.Full);
And I am using the following coding to test the decryption:
System.Configuration.Configuration config =
ConfigurationManager.OpenExeConfiguration(configFile);
ConnectionStringsSection connSection = config.ConnectionStrings;
int i = 1;
foreach (ConnectionStringSettings settings in connSection.ConnectionStrings)
Console.WriteLine(i.ToString() + ":" + settings.ProviderName + ";" + settings.ConnectionString);
i++;
The output for the decryption are as following:
1: System.Data.SqlClient;data source=.\SQLEXPRESS;Integrated Security=SSPI;Attach
DBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true
2: System.Data.OracleClient;Data Source=aaa;User ID=bbb;password=ccc
Could any of you tell me what I am doing wrong? Thanks.

Answer 1

For the benefit of anyone who comes across this question:
configFile, is meant to be the exePath. OpenExeConfiguration will open the exe's config file and then encrypt it, and then save a "{exePath}.config" file.
If you use notepad to check then you will see encrypted strings.
If you want to use code to check use:
System.Configuration.Configuration config = ConfigurationManager.OpenExeConfiguration(exePath);
config.GetSection("connectionsStrings").SectionInformation.IsProtected
If you use code to read the config file, then that will only show decrypted values (#2 in the listed output)
The extra data connection (#1) comes from a config file higher up in the hierachy, e.g. machine.config